{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/infinitycore-android-scheduler/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:infinitycore:android_scheduler:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-98385"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InfinityCore Android Scheduler"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","android","kernel-exploit"],"_cs_type":"advisory","_cs_vendors":["InfinityCore"],"content_html":"\u003cp\u003eCVE-2026-98385 is a local privilege escalation (LPE) vulnerability affecting the InfinityCore Android scheduler. The flaw originates in the scheduler's cache accounting mechanism, which fails to protect the lifecycle of per-CPU statistics associated with a task's mm_struct. When a task performs an exec() call on a different CPU, the address space can be replaced, leading to a race condition where the scheduler continues to write to the old address space.\u003c/p\u003e\n\u003cp\u003eThis results in memory corruption that an attacker can leverage to target the reference counter of a private futex hash. By reclaiming the freed hash memory using a pipe ring, an attacker can manipulate kernel structures to overwrite the task_struct-\u0026gt;cred, effectively granting the attacker root privileges. Successful exploitation requires specific kernel configurations: CONFIG_SCHED_CACHE must be enabled, sched_cache_active must be active at runtime, the system must support SD_SHARE_LLC with multiple CPUs, and sysctl_sched_cache_user must not be set to zero.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker initializes a malicious environment by confirming CONFIG_SCHED_CACHE=y and sysctl_sched_cache_user != 0.\u003c/li\u003e\n\u003cli\u003eThe exploit process uses sched_setattr to establish scheduling parameters for capability verification.\u003c/li\u003e\n\u003cli\u003eThe process allocates a 128 MB address space buffer to facilitate page churn.\u003c/li\u003e\n\u003cli\u003eA victim process is forked and set to SCHED_IDLE, periodically invoking execve to free its own mm_struct.\u003c/li\u003e\n\u003cli\u003eA helper thread creates page fluctuations using readv(/dev/zero) and nanosleep to induce the race condition.\u003c/li\u003e\n\u003cli\u003eThe main thread performs an iterative loop (up to 4096 times) of sched_setattr to trigger the use-after-free in the futex hash.\u003c/li\u003e\n\u003cli\u003eThe exploit reclaims the freed futex hash memory using a pipe ring to facilitate arbitrary data manipulation.\u003c/li\u003e\n\u003cli\u003eThe exploit overwrites the task_struct-\u0026gt;cred of the current process to set the UID to zero, followed by spawning /system/bin/sh.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-98385 results in a complete compromise of the affected Android device. An unprivileged attacker can transition to root privileges, bypassing system security controls and gaining full read/write access to the device filesystem, user data, and system binaries. This vulnerability impacts any Android implementation utilizing the vulnerable InfinityCore scheduler code path with the specified kernel configurations enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAudit kernel configurations on Android deployments to verify if CONFIG_SCHED_CACHE is enabled; if unnecessary, disable the feature in the kernel build.\u003c/li\u003e\n\u003cli\u003eMonitor and restrict the sysctl_sched_cache_user setting; ensure it is set to zero if the scheduler cache feature is not required for production workloads.\u003c/li\u003e\n\u003cli\u003eImplement kernel-level integrity monitoring to detect anomalous writes to the task_struct structure.\u003c/li\u003e\n\u003cli\u003eDeploy updates provided by the device manufacturer or InfinityCore maintainers that apply the patch for CVE-2026-98385.\u003c/li\u003e\n\u003cli\u003ePerform local security assessments using kernel BTF or vmlinux symbols to identify if the target kernel is susceptible to the defined structure offsets in the LPE chain.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T00:59:31Z","date_published":"2026-10-19T00:59:31Z","id":"https://feed.craftedsignal.io/briefs/2026-10-infinitycore-lpe/","summary":"CVE-2026-98385 is a local privilege escalation vulnerability in the InfinityCore Android scheduler stemming from a use-after-free condition in per-CPU cache statistics, allowing attackers to overwrite task credentials.","title":"Local Privilege Escalation in InfinityCore Android Scheduler","url":"https://feed.craftedsignal.io/briefs/2026-10-infinitycore-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - InfinityCore Android Scheduler","version":"https://jsonfeed.org/version/1.1"}