A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-46242 and dubbed “Bad Epoll,” exposes a critical race-condition use-after-free (UAF) flaw in the epoll subsystem that allows unprivileged users to escalate privileges to root across Linux systems and potentially Android devices.
The flaw was discovered and exploited by security researcher Jaeyoung Chung as part of Google’s kernelCTF program, highlighting both the real-world exploitability and high impact of subtle concurrency bugs in core kernel components.
Unlike many previous privilege-escalation flaws, Bad Epoll is particularly severe because it affects a fundamental kernel mechanism widely used by system services, networking stacks, and modern browsers, leaving no straightforward mitigation beyond patching.
Bad Epoll Linux Kernel UAF Flaw
The vulnerability originates from a race condition introduced in April 2023 (commit 58c9b016e128) within the epoll event notification subsystem.
The issue arises when two epoll instances are closed concurrently, leading to a race in which one thread frees a structure. At the same time, another continues to operate on it, resulting in a use-after-free condition.
Although the race window is extremely narrow, estimated at just a few CPU instructions, the researcher demonstrated a highly reliable exploitation technique that expands the race condition window and repeatedly triggers it without crashing the kernel.
This approach achieves approximately 99% success in controlled environments, making the flaw far more practical than typical race-condition vulnerabilities.
Technically, the exploit leverages multiple epoll objects arranged in paired configurations to trigger and control the race. After achieving a controlled UAF write, the attacker transitions the primitive into a more powerful cross-cache attack targeting kernel file objects.
This enables arbitrary kernel memory reads via interfaces such as /proc/self/fdinfo, eventually allowing control-flow hijacking via a return-oriented programming (ROP) chain.
The result is full kernel code execution and a root shell, achieved entirely from an unprivileged context. Notably, researchers confirmed that the flaw can be triggered even within restricted environments such as Chrome’s renderer sandbox, making it a valuable candidate for exploit chains.
One of the most concerning aspects of Bad Epoll is its relevance to Android. Historically, only a small subset of Linux kernel vulnerabilities have been viable for rooting Android devices due to platform-specific constraints.
However, Bad Epoll joins a rare class of bugs capable of bypassing these limitations. Early testing indicates that devices running kernels version 6.6 or later, such as newer Pixel models, may be vulnerable, with a full Android exploit reportedly in progress. Older devices based on kernel version 6.1 are not affected, as the vulnerable code was introduced in later versions.
Interestingly, the vulnerability coexists with another epoll-related race condition (CVE-2026-43074) previously discovered by Anthropic’s AI system, Mythos. While Mythos successfully identified one bug in the same code path, it failed to detect Bad Epoll, underscoring the difficulty of identifying race conditions with minimal runtime indicators.
The lack of consistent detection signals, such as KASAN alerts, combined with the extremely tight race window, likely contributed to the oversight. Even kernel maintainers initially struggled to implement a complete fix, with the final patch only landing on April 24, 2026 (commit a6dc643c6931), two months after initial disclosure.
Given that epoll is a core kernel feature with no disable option, there are no viable workarounds or mitigations aside from applying the official patch or vendor backports. Systems running Linux kernel versions 6.4 and newer are potentially impacted if unpatched.
Security teams are strongly advised to prioritize kernel updates and monitor distribution advisories to ensure remediation, especially in environments where unprivileged user access is possible, or browser sandbox escape scenarios are a concern.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
 flaw.){kind=link}