{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3oinfinitycoreandroid/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:infinitycore:android:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-80775"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InfinityCore Android"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","kernel","android","cve-2026-80775"],"_cs_type":"advisory","_cs_vendors":["InfinityCore"],"content_html":"\u003cp\u003eCVE-2026-80775 is a critical memory corruption vulnerability identified in the InfinityCore Android kernel's Futex subsystem. The flaw arises from a race condition triggered when two tasks share an mm_struct through nested vfork() calls during the allocation of a FUTEX_PRIVATE_HASH reference counter. If the tasks publish conflicting per-CPU counter addresses to the shared memory, a reference is lost, leading to an incorrect hash release and subsequent use-after-free access when the kernel later attempts to use the freed bucket pointer. An attacker can leverage this use-after-free condition to corrupt kernel memory and overwrite the task_struct-\u0026gt;cred structure, effectively elevating the process's privilege to root (UID 0). A proof-of-concept exploit targeting the ARM64 platform has been publicly released, necessitating urgent attention for kernel updates.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe exploit performs initial environment probing by calling prctl(PR_FUTEX_HASH, GET_SLOTS) to confirm kernel compatibility.\u003c/li\u003e\n\u003cli\u003eThe process enters an iterative loop (up to 256 times) to manipulate the Futex hash layout, setting hash slots to 8.\u003c/li\u003e\n\u003cli\u003eA helper process is spawned and synchronized using clock_nanosleep(TIMER_ABSTIME) to facilitate precise preemption timing.\u003c/li\u003e\n\u003cli\u003eA target process is created, which acquires a warm lock before dropping its scheduling priority to SCHED_IDLE (nice 19) to create the race window.\u003c/li\u003e\n\u003cli\u003eThe primary controller resizes the Futex hash to 2^18, triggering the race condition while the helper process is sleeping.\u003c/li\u003e\n\u003cli\u003eThe exploit floods the system with pipe structures to reclaim the memory previously freed by the Futex hash release.\u003c/li\u003e\n\u003cli\u003eThe attacker-controlled memory inside the pipe buffer is used to overwrite the task_struct-\u0026gt;cred object in the kernel.\u003c/li\u003e\n\u003cli\u003eUpon successful overwrite, the process UID is elevated to zero, resulting in the execution of a root-privileged /system/bin/sh shell.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows any local unprivileged application or user on an affected Android device to achieve full root privileges. Successful exploitation results in complete compromise of the device's security model, bypassing all permission boundaries and allowing for arbitrary code execution with kernel-level authority, data exfiltration, and persistent access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eMonitor for kernel updates from InfinityCore and apply the patch addressing CVE-2026-80775 immediately.\u003c/li\u003e\n\u003cli\u003eImplement kernel-level integrity monitoring to detect anomalous modifications to task_struct credentials.\u003c/li\u003e\n\u003cli\u003eRestrict the ability of untrusted applications to utilize advanced Futex operations or custom system call flags if the kernel interface can be hardened.\u003c/li\u003e\n\u003cli\u003ePerform memory forensic analysis on devices suspected of unauthorized privilege escalation to identify potential use-after-free corruption artifacts.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T00:59:38Z","date_published":"2026-10-19T00:59:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-infinitycore-futex-lpe/","summary":"A local privilege escalation vulnerability (CVE-2026-80775) in the InfinityCore Android kernel allows attackers to achieve root access via a race condition in the Futex subsystem.","title":"InfinityCore Android Futex Race Condition Privilege Escalation","url":"https://feed.craftedsignal.io/briefs/2026-10-infinitycore-futex-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:o:infinitycore:android:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}