Ubuntu kernel notice and Infinity Core LPEs

Ubuntu patched old kernel info-leak and crash bugs as researchers disclosed six separate local privilege-escalation flaws.

Two separate Linux kernel disclosures appeared within days. Ubuntu’s USN-8924-1, dated 2026-10-13, covers older flaws: CVE-2017-5967 can leak a real PID from a PID namespace via timer stats, while CVE-2018-13093 and a separate f2fs metadata-validation issue can crash the system when a malicious image is mounted. Ubuntu reports no exploitation. On 2026-10-16, Hyunwoo Kim published Infinity Core after a linux-distros embargo ended, describing six vulnerabilities in Timer, Signal, MM, Futex, Scheduler, and SLAB that the post says can enable local privilege escalation on servers, container escape, and Android local privilege escalation. That post does not assign CVE identifiers or claim in-the-wild use. The sources do not say the Ubuntu CVEs are among the six Infinity Core bugs, so the timer overlap is not treated as the same issue.

• On 2026-10-13 Ubuntu published USN-8924-1 for long-known Linux kernel flaws.
• CVE-2017-5967 in timer stats can let a local attacker learn a real PID from inside a PID namespace.
• CVE-2018-13093 is an XFS inode-tracking flaw that a malicious filesystem image can crash when mounted.
• USN-8924-1 also describes an f2fs metadata-validation issue with the same denial-of-service impact; no exploitation is reported.
• On 2026-10-16 Hyunwoo Kim published Infinity Core after a linux-distros embargo expired.
• Infinity Core describes six flaws in the Timer, Signal, MM, Futex, Scheduler, and SLAB subsystems, with stated impact of server local privilege escalation, container escape, and Android local privilege escalation.
• The Infinity Core post names no CVE identifiers and does not state that exploitation has been observed.