{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/infinitycore/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:infinitycore:signal_subsystem:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-98256"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InfinityCore Signal subsystem"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","android","kernel","cve-2026-98256"],"_cs_type":"advisory","_cs_vendors":["InfinityCore"],"content_html":"\u003cp\u003eCVE-2026-98256 is a high-severity race condition vulnerability affecting the InfinityCore Signal subsystem on Android/ARM64 devices. The flaw originates from improper handling of signal queue cleanup when an exec() operation is invoked by a non-leader thread, causing a conflict with the private pending signal queue of a dying leader thread. This race condition leads to kernel-level memory corruption as a signal entry is linked into a new queue after its parent object has been freed.\u003c/p\u003e\n\u003cp\u003eThe exploitation chain utilizes a surviving signal entry as an oracle to confirm memory reclamation before executing a series of heap-based maneuvers to overwrite kernel credentials. The released exploit proof-of-concept (PoC) automates this process using timing windows and ptrace-based memory manipulation to achieve a root shell. Given the publication of functional exploit code, Android devices utilizing the affected InfinityCore Signal subsystem are at elevated risk of local privilege escalation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker forks a controller process to orchestrate the race condition across multiple timing windows.\u003c/li\u003e\n\u003cli\u003eThe controller forks child processes that invoke exit_group to trigger thread death and initiate signal cleanup.\u003c/li\u003e\n\u003cli\u003eA non-leader thread floods the system with 20,000 per-thread timers against the old leader to force sigqueue event generation.\u003c/li\u003e\n\u003cli\u003eAn execveat system call is triggered to induce the race condition during the cleanup of the signal queue.\u003c/li\u003e\n\u003cli\u003eThe post-exec process scans the residual pending queue and reclaims freed objects using a ktimer heap spray.\u003c/li\u003e\n\u003cli\u003eThe exploit decodes the freelist to identify object addresses and uses a ptrace parent process to perform AIO (Asynchronous I/O) page reclaim.\u003c/li\u003e\n\u003cli\u003eA forged timer is triggered to finalize kernel memory corruption.\u003c/li\u003e\n\u003cli\u003eThe exploit overwrites the process credentials in the kernel, resulting in a shell with root privileges.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-98256 results in local privilege escalation, granting an attacker root access to the underlying Android system. This bypasses standard Android security boundaries, allowing for full system compromise, data exfiltration, and the persistence of malicious code at the kernel level. The exploit targets ARM64-based Android kernels and requires local access to the device.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all Android devices in the fleet running kernels incorporating the InfinityCore Signal subsystem and verify patching status against vendor security bulletins.\u003c/li\u003e\n\u003cli\u003ePrioritize patching for all devices running affected ARM64-based Android kernel builds.\u003c/li\u003e\n\u003cli\u003eImplement kernel-level monitoring for suspicious ptrace calls and unusual signal queue activity if telemetry is available.\u003c/li\u003e\n\u003cli\u003eSince this is a local privilege escalation (LPE), ensure robust device management policies are in place to restrict unauthorized application installation and sideloading, which could facilitate the deployment of this exploit.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T00:59:48Z","date_published":"2026-10-19T00:59:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-infinitycore-signal-lpe/","summary":"A publicly available exploit for CVE-2026-98256 enables local privilege escalation on Android/ARM64 systems by leveraging a race condition in the InfinityCore Signal subsystem to gain a root shell.","title":"Race Condition Privilege Escalation in InfinityCore Signal Subsystem (CVE-2026-98256)","url":"https://feed.craftedsignal.io/briefs/2026-10-infinitycore-signal-lpe/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:infinitycore:android:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-80775"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InfinityCore Android"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","kernel","android","cve-2026-80775"],"_cs_type":"advisory","_cs_vendors":["InfinityCore"],"content_html":"\u003cp\u003eCVE-2026-80775 is a critical memory corruption vulnerability identified in the InfinityCore Android kernel's Futex subsystem. The flaw arises from a race condition triggered when two tasks share an mm_struct through nested vfork() calls during the allocation of a FUTEX_PRIVATE_HASH reference counter. If the tasks publish conflicting per-CPU counter addresses to the shared memory, a reference is lost, leading to an incorrect hash release and subsequent use-after-free access when the kernel later attempts to use the freed bucket pointer. An attacker can leverage this use-after-free condition to corrupt kernel memory and overwrite the task_struct-\u0026gt;cred structure, effectively elevating the process's privilege to root (UID 0). A proof-of-concept exploit targeting the ARM64 platform has been publicly released, necessitating urgent attention for kernel updates.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe exploit performs initial environment probing by calling prctl(PR_FUTEX_HASH, GET_SLOTS) to confirm kernel compatibility.\u003c/li\u003e\n\u003cli\u003eThe process enters an iterative loop (up to 256 times) to manipulate the Futex hash layout, setting hash slots to 8.\u003c/li\u003e\n\u003cli\u003eA helper process is spawned and synchronized using clock_nanosleep(TIMER_ABSTIME) to facilitate precise preemption timing.\u003c/li\u003e\n\u003cli\u003eA target process is created, which acquires a warm lock before dropping its scheduling priority to SCHED_IDLE (nice 19) to create the race window.\u003c/li\u003e\n\u003cli\u003eThe primary controller resizes the Futex hash to 2^18, triggering the race condition while the helper process is sleeping.\u003c/li\u003e\n\u003cli\u003eThe exploit floods the system with pipe structures to reclaim the memory previously freed by the Futex hash release.\u003c/li\u003e\n\u003cli\u003eThe attacker-controlled memory inside the pipe buffer is used to overwrite the task_struct-\u0026gt;cred object in the kernel.\u003c/li\u003e\n\u003cli\u003eUpon successful overwrite, the process UID is elevated to zero, resulting in the execution of a root-privileged /system/bin/sh shell.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows any local unprivileged application or user on an affected Android device to achieve full root privileges. Successful exploitation results in complete compromise of the device's security model, bypassing all permission boundaries and allowing for arbitrary code execution with kernel-level authority, data exfiltration, and persistent access.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eMonitor for kernel updates from InfinityCore and apply the patch addressing CVE-2026-80775 immediately.\u003c/li\u003e\n\u003cli\u003eImplement kernel-level integrity monitoring to detect anomalous modifications to task_struct credentials.\u003c/li\u003e\n\u003cli\u003eRestrict the ability of untrusted applications to utilize advanced Futex operations or custom system call flags if the kernel interface can be hardened.\u003c/li\u003e\n\u003cli\u003ePerform memory forensic analysis on devices suspected of unauthorized privilege escalation to identify potential use-after-free corruption artifacts.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T00:59:38Z","date_published":"2026-10-19T00:59:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-infinitycore-futex-lpe/","summary":"A local privilege escalation vulnerability (CVE-2026-80775) in the InfinityCore Android kernel allows attackers to achieve root access via a race condition in the Futex subsystem.","title":"InfinityCore Android Futex Race Condition Privilege Escalation","url":"https://feed.craftedsignal.io/briefs/2026-10-infinitycore-futex-lpe/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:infinitycore:android_scheduler:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-98385"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InfinityCore Android Scheduler"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","android","kernel-exploit"],"_cs_type":"advisory","_cs_vendors":["InfinityCore"],"content_html":"\u003cp\u003eCVE-2026-98385 is a local privilege escalation (LPE) vulnerability affecting the InfinityCore Android scheduler. The flaw originates in the scheduler's cache accounting mechanism, which fails to protect the lifecycle of per-CPU statistics associated with a task's mm_struct. When a task performs an exec() call on a different CPU, the address space can be replaced, leading to a race condition where the scheduler continues to write to the old address space.\u003c/p\u003e\n\u003cp\u003eThis results in memory corruption that an attacker can leverage to target the reference counter of a private futex hash. By reclaiming the freed hash memory using a pipe ring, an attacker can manipulate kernel structures to overwrite the task_struct-\u0026gt;cred, effectively granting the attacker root privileges. Successful exploitation requires specific kernel configurations: CONFIG_SCHED_CACHE must be enabled, sched_cache_active must be active at runtime, the system must support SD_SHARE_LLC with multiple CPUs, and sysctl_sched_cache_user must not be set to zero.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker initializes a malicious environment by confirming CONFIG_SCHED_CACHE=y and sysctl_sched_cache_user != 0.\u003c/li\u003e\n\u003cli\u003eThe exploit process uses sched_setattr to establish scheduling parameters for capability verification.\u003c/li\u003e\n\u003cli\u003eThe process allocates a 128 MB address space buffer to facilitate page churn.\u003c/li\u003e\n\u003cli\u003eA victim process is forked and set to SCHED_IDLE, periodically invoking execve to free its own mm_struct.\u003c/li\u003e\n\u003cli\u003eA helper thread creates page fluctuations using readv(/dev/zero) and nanosleep to induce the race condition.\u003c/li\u003e\n\u003cli\u003eThe main thread performs an iterative loop (up to 4096 times) of sched_setattr to trigger the use-after-free in the futex hash.\u003c/li\u003e\n\u003cli\u003eThe exploit reclaims the freed futex hash memory using a pipe ring to facilitate arbitrary data manipulation.\u003c/li\u003e\n\u003cli\u003eThe exploit overwrites the task_struct-\u0026gt;cred of the current process to set the UID to zero, followed by spawning /system/bin/sh.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-98385 results in a complete compromise of the affected Android device. An unprivileged attacker can transition to root privileges, bypassing system security controls and gaining full read/write access to the device filesystem, user data, and system binaries. This vulnerability impacts any Android implementation utilizing the vulnerable InfinityCore scheduler code path with the specified kernel configurations enabled.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAudit kernel configurations on Android deployments to verify if CONFIG_SCHED_CACHE is enabled; if unnecessary, disable the feature in the kernel build.\u003c/li\u003e\n\u003cli\u003eMonitor and restrict the sysctl_sched_cache_user setting; ensure it is set to zero if the scheduler cache feature is not required for production workloads.\u003c/li\u003e\n\u003cli\u003eImplement kernel-level integrity monitoring to detect anomalous writes to the task_struct structure.\u003c/li\u003e\n\u003cli\u003eDeploy updates provided by the device manufacturer or InfinityCore maintainers that apply the patch for CVE-2026-98385.\u003c/li\u003e\n\u003cli\u003ePerform local security assessments using kernel BTF or vmlinux symbols to identify if the target kernel is susceptible to the defined structure offsets in the LPE chain.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-10-19T00:59:31Z","date_published":"2026-10-19T00:59:31Z","id":"https://feed.craftedsignal.io/briefs/2026-10-infinitycore-lpe/","summary":"CVE-2026-98385 is a local privilege escalation vulnerability in the InfinityCore Android scheduler stemming from a use-after-free condition in per-CPU cache statistics, allowing attackers to overwrite task credentials.","title":"Local Privilege Escalation in InfinityCore Android Scheduler","url":"https://feed.craftedsignal.io/briefs/2026-10-infinitycore-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - InfinityCore","version":"https://jsonfeed.org/version/1.1"}