Critical "Bad Epoll" Linux Kernel Flaw Enables Root Escalation on Servers, Desktops, and Android
A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-46242 and dubbed "Bad Epoll," allows unprivileged local attackers to escalate privileges to root on Linux servers, desktops, and Android devices. The flaw stems from a use-after-free (UAF) and race condition in the kernel’s epoll subsystem, a core component that cannot be disabled without breaking critical OS functionality.
The vulnerability was discovered and exploited by security researcher Jaeyoung Chung, who submitted it as a zero-day to Google’s kernelCTF program, earning a $71,337+ bounty. Unlike most Linux privilege-escalation bugs, Bad Epoll is particularly dangerous because it affects Android and can be chained with Chrome renderer sandbox escapes, enabling full kernel code execution.
The exploit targets a race condition in ep_remove(), where a concurrent __fput() call can observe a transient NULL value, bypassing cleanup and freeing a struct eventpoll still in use. This corrupts kernel memory, and due to SLAB_TYPESAFE_BY_RCU, the freed memory slot may be recycled, allowing attackers to trigger a kmem_cache_free() on the wrong slab cache.
Chung’s exploit achieves ~99% reliability by widening the narrow race window (just six instructions) and retrying without crashing the system. The attack leverages four epoll objects two to trigger the race and two as victim objects converting an 8-byte UAF write into a full file object UAF via a cross-cache attack. From there, attackers gain arbitrary kernel memory read access via /proc/self/fdinfo and execute a return-oriented programming (ROP) chain to spawn a root shell.
The flaw was introduced by a 2023 kernel commit that added two separate race conditions in the same 2,500-line epoll code path. While the first (CVE-2026-43074) was detected by Anthropic’s AI model Mythos, Bad Epoll evaded automated discovery due to its narrow timing window and minimal runtime evidence, rarely triggering KASAN (the kernel’s memory-error detector). Initial patch attempts were incomplete, and a correct fix took nearly two months to land.
With no workaround available, administrators must apply the upstream patch or await distribution backports to mitigate the risk. The vulnerability underscores the growing complexity of kernel race conditions and the challenges in detecting them, even with advanced AI-assisted tools.
Source: https://cybersecuritynews.com/bad-epoll-0-day-vulnerability/
Kernel Foundation - Master Linux Kernel & LDD cybersecurity rating report: https://www.rankiteo.com/company/linux-kernel-foundation
"id": "LIN1783139025",
"linkid": "linux-kernel-foundation",
"type": "Vulnerability",
"date": "1/2023",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Linux servers, desktops, and '
'Android devices worldwide',
'industry': 'Technology/Software',
'location': 'Global',
'name': 'Linux Kernel',
'type': 'Operating System'}],
'attack_vector': 'Local',
'description': 'A newly disclosed Linux kernel vulnerability, tracked as '
"CVE-2026-46242 and dubbed 'Bad Epoll,' allows unprivileged "
'local attackers to escalate privileges to root on Linux '
'servers, desktops, and Android devices. The flaw stems from a '
'use-after-free (UAF) and race condition in the kernel’s epoll '
'subsystem, a core component that cannot be disabled without '
'breaking critical OS functionality. The exploit achieves ~99% '
'reliability and can be chained with Chrome renderer sandbox '
'escapes for full kernel code execution.',
'impact': {'operational_impact': 'Privilege escalation to root, potential '
'full kernel code execution',
'systems_affected': 'Linux servers, desktops, and Android devices'},
'investigation_status': 'Vulnerability patched (upstream fix available)',
'lessons_learned': 'The vulnerability underscores the growing complexity of '
'kernel race conditions and the challenges in detecting '
'them, even with advanced AI-assisted tools.',
'motivation': 'Bug Bounty (Google’s kernelCTF program)',
'post_incident_analysis': {'corrective_actions': 'Upstream patch applied to '
'fix the vulnerability. '
'Initial incomplete patches '
'were revised over two '
'months.',
'root_causes': 'Use-after-free and race condition '
'in the epoll subsystem introduced '
'by a 2023 kernel commit. Narrow '
'timing window and minimal runtime '
'evidence made detection '
'difficult.'},
'recommendations': 'Apply the upstream patch or await distribution backports '
'to mitigate the risk. No workaround is available.',
'references': [{'source': 'Google’s kernelCTF program'},
{'source': 'Anthropic’s AI model Mythos'}],
'response': {'containment_measures': 'Apply upstream patch or await '
'distribution backports',
'remediation_measures': 'Patch the Linux kernel to fix the '
'use-after-free and race condition'},
'threat_actor': 'Jaeyoung Chung (Security Researcher)',
'title': "Critical 'Bad Epoll' Linux Kernel Flaw Enables Root Escalation on "
'Servers, Desktops, and Android',
'type': 'Privilege Escalation',
'vulnerability_exploited': 'CVE-2026-46242 (Use-after-free and race condition '
'in epoll subsystem)'}