Bad Epoll Linux Flaw Lets Unprivileged Users Gain Root Access

A newly disclosed Linux kernel vulnerability dubbed "Bad Epoll" (CVE-2026-46242) enables unprivileged users to escalate privileges and gain root access on affected systems. The flaw resides in the epoll subsystem, a core Linux feature used by servers, browsers, and network services to monitor multiple file descriptors simultaneously. Discovered by researcher Jaeyoung Chung and submitted as a zero-day through Google's kernelCTF bug bounty program, the vulnerability impacts Linux desktops, servers, and Android devices running kernels 6.4 or newer. There is no workaround, as epoll cannot be disabled; administrators should apply upstream commit a6dc643c6931 or install their distribution's security backport when it lands.

The bug is a use-after-free condition triggered when two kernel code paths attempt to release the same internal object concurrently. One path frees the memory while the other is still writing to it, creating a brief window of only about six machine instructions for kernel memory corruption. Chung's exploit widens this race-condition window and retries without crashing, achieving root privileges approximately 99% of the time on tested hardware. Notably, the exploit can be triggered from within Chrome's renderer sandbox, which typically blocks most kernel-level attacks, and it extends to Android, a platform rarely affected by Linux privilege-escalation bugs. An Android-specific proof-of-concept is reportedly still in development.

Both Bad Epoll and a related flaw (CVE-2026-43074) trace back to a single 2023 change in the epoll code. The sibling bug was identified by Anthropic's Mythos AI model earlier in 2026, but the AI failed to detect Bad Epoll. Chung attributes this likely to the tiny timing window and the absence of runtime evidence: once the first bug is patched, Bad Epoll's memory errors usually go undetected by KASAN, the kernel's primary bug-detection tool. As of publication, the vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation has been reported. Server administrators concerned about exposure can run a quick port scanner to inventory listening services, while users should perform a broader privacy checkup to verify their devices are patched and hardened against kernel-level threats.