Multiple security vulnerabilities have been identified in the Linux kernel, affecting versions 7.0 and 7.2. The flaws involve local privilege escalation, container escape, and kernel crash scenarios, with public proof-of-concept exploits available. This creates a high risk for systems where untrusted local code can run, especially multi-tenant hosts, container nodes, and shared build environments. The combination of local attack surface and public exploit material increases urgency for exposure control.
CVE-2026-98260 (CVSS 7.8 — High): A flaw in POSIX timer cleanup during thread termination in the kernel execution path can be exploited by a local attacker to gain elevated privileges or escape a container.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in the Linux kernel, affecting versions 7.0 and 7.2. The flaws involve local privilege escalation, container escape, and kernel crash scenarios, with public proof-of-concept exploits available. This creates a high risk for systems where untrusted local code can run, especially multi-tenant hosts, container nodes, and shared build environments. The combination of local attack surface and public exploit material increases urgency for exposure control.
CVE-2026-98260 (CVSS 7.8 — High): A flaw in POSIX timer cleanup during thread termination in the kernel execution path can be exploited by a local attacker to gain elevated privileges or escape a container.[emaillocker id="1283"]
CVE-2026-98256 (CVSS 7.8 — High): A race condition in signal handling during process execution can allow a local attacker to corrupt kernel state and achieve privilege escalation or container escape.
CVE-2026-89754 (CVSS 7.8 — High): A stale action state in the kernel page-walk subsystem can be abused by a local attacker to manipulate memory handling and gain elevated privileges or escape a container.
CVE-2026-80775: It is a Linux kernel vulnerability, but public details are limited and the specific flaw, affected component, and exploitation path are not identified. The attacker capability is not specified.
CVE-2026-98385: It is a Linux kernel vulnerability, but public details are limited and the specific flaw, affected component, and exploitation path are not identified. The attacker capability is not specified.
CVE-2026-97941 (CVSS 7.8 — High): A locking race in the kernel memory slab allocator can be exploited by a local attacker to corrupt allocator state and achieve privilege escalation or container escape.
These vulnerabilities collectively present a high risk to systems where local untrusted code can run, particularly multi-tenant hosts, container nodes, and shared build environments. The availability of public proof-of-concept exploits increases the likelihood of exploitation. Organizations should prioritize these flaws in vulnerability management.
We recommend you to update Linux kernel to version 6.6.158, 6.12.112, 6.18.54, 6.18.50, 6.18.47, 7.1.11, 7.2.9, or 7.2.7 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]