Bad Epoll (CVE-2026-46242): Use-After-Free Zero-Day in Linux Kernel epoll Subsystem Enables Root Privilege Escalation

Bad Epoll (CVE-2026-46242) (TL-2026-1105), also tracked as Bad Epoll, is a high-severity software vulnerability, first published 2026-07-05. It has no confirmed attribution, affects Linux Kernel Community Linux Kernel (mainline & LTS), references 2 CVEs (CVE-2026-46242, CVE-2026-43074), maps to 21 MITRE ATT&CK techniques (T1003.008, T1057, T1059.004), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-1105

Threat ID
TL-2026-1105
Also known as
Bad Epoll
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-05
Last reviewed
2026-07-05
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
cross-sector, cloud hosting providers, mobile device ecosystem android
Target regions
Global
Detection rules
9
Indicators of compromise
27

Malware and tooling in Bad Epoll (CVE-2026-46242)

Malware and tooling: Claude Mythos (Preview), Falco, auditd

A zero-day use-after-free vulnerability (CVE-2026-46242), dubbed 'Bad Epoll,' in the Linux kernel's epoll subsystem (ep_remove()) lets an unprivileged local user win a ~6-instruction race to corrupt kernel memory and escalate to root on Linux servers, desktops, and Android devices running kernel v6.4+. Researcher Jaeyoung Chung's kernelCTF-submitted exploit reaches root with ~99% reliability and is even triggerable from inside Chrome's sandboxed renderer process; the kernel maintainers' first patch attempt (for a related, Anthropic Mythos-discovered CVE-2026-43074) was incomplete, and a correct fix did not land until nearly two months after initial disclosure.

How Bad Epoll (CVE-2026-46242) works

Bad Epoll (CVE-2026-46242) is a use-after-free (UAF) vulnerability in the Linux kernel's epoll subsystem, specifically in the ep_remove() cleanup path. The function clears file->f_ep under file->f_lock but continues operating on the file object during hlist_del_rcu() and spin_unlock(). A concurrent __fput() call can observe a NULL f_ep value, skip eventpoll_release_file(), and proceed directly into f_op->release, freeing an active struct eventpoll object that is still in use elsewhere in the kernel. The race window is only about six machine instructions wide, but researcher Jaeyoung Chung's exploit reliably wins it using a timer-interrupt-based widening technique combined with a retry loop that never crashes the target kernel.

The bug and a sibling race condition (CVE-2026-43074) were both introduced by a single commit, 58c9b016e128, merged into mainline Linux on 2023-04-08 as part of a roughly 2,500-line change to the epoll subsystem. Jaeyoung Chung -- a PhD student in the CompSec Lab at Seoul National University, advised by Prof. Byoungyoung Lee -- first reported the underlying epoll race-condition issue to kernel maintainers on 2026-02-17. Independently, the first of the two races (CVE-2026-43074) was discovered by Anthropic's Claude Mythos (Preview) AI model during automated kernel code review under Project Glasswing (publicly announced 2026-04-07), and was patched in mainline on 2026-04-02. That patch, however, addressed only one of the two race conditions and had the side effect of removing the KASAN signal that might otherwise have surfaced the second, harder-to-spot bug -- the flaw Mythos itself did not catch, likely due to its narrow timing window and low probability of triggering KASAN. Chung determined the 2 April patch was incomplete and re-reported the remaining race (subsequently named Bad Epoll) on 2026-04-22, and the correct upstream fix landed two days later as commit a6dc643c6931 -- nearly two months after Chung's original report to kernel maintainers.

Chung's working exploit, submitted as a zero-day to Google's kernelCTF program (rewarded at $71,337 or more), converts the initial 8-byte UAF write into a full use-after-free on a struct file object via a cross-cache attack. It then achieves an arbitrary kernel memory read by dangling a struct file reference and reading it back out through /proc/self/fdinfo, using the leak to defeat KASLR before hijacking control flow with a ROP chain to obtain a root shell. The technique uses four linked epoll file descriptors arranged in two pairs -- one pair to repeatedly trigger the race, the other to serve as the corrupted victim object -- and reaches root reliably without ever crashing the kernel: approximately 99% reliability on the kernelCTF LTS-6.12.67 target and 98% on the COS-121 target.

Because epoll is used pervasively across Linux user space (including inside browser sandboxes), Bad Epoll is exploitable from within Chrome's sandboxed renderer process; an attacker who already has renderer-level code execution (e.g., via a browser memory-corruption bug or malicious web content) could chain Bad Epoll to escape the sandbox entirely and escalate to root on the host. The bug affects Linux kernel v6.4 and later -- it is absent from v6.1-based kernel trees, meaning devices such as the Pixel 8 that ship v6.1-based kernels are not affected, while most modern Linux servers, desktops, and newer Android devices running kernel v6.4+ are exposed until patched. There is no workaround: epoll cannot be disabled without breaking core OS and browser functionality. Enabling KASLR and SLUB/heap randomization can disrupt the exploit's dependency on predictable heap layout as a partial mitigation, but administrators must apply the upstream fix or an equivalent distribution backport to fully remediate. As of the 2026-07-04 public disclosure, CVE-2026-46242 does not appear on CISA's Known Exploited Vulnerabilities catalog and there is no confirmed evidence of in-the-wild exploitation; the primary near-term risk is that the now-public, highly reliable PoC lowers the bar for any actor targeting unpatched multi-tenant Linux infrastructure, CI/build systems, or Android devices. Notably, Chung's independent report predates Anthropic's public Project Glasswing update (2026-05-22), in which partner organizations reported collectively surfacing over 10,000 high-or-critical-severity vulnerabilities within roughly one month using Mythos Preview -- illustrating that large-scale AI-assisted kernel auditing and dedicated human research are now surfacing overlapping classes of concurrency bugs in parallel, with neither modality alone sufficient to fully close a multi-bug commit.

MITRE ATT&CK techniques used in TL-2026-1105

Credential Access

T1003.008 /etc/passwd and /etc/shadow

Discovery

T1057 Process Discovery; T1082 System Information Discovery; T1518.001 Security Software Discovery

Execution

T1059.004 Unix Shell; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548.001 Setuid and Setgid; T1548.003 Sudo and Sudo Caching; T1611 Escape to Host

Defense Evasion

T1078 Valid Accounts; T1211 Exploitation for Stealth

Persistence

T1136.001 Local Account; T1542 Pre-OS Boot

Initial Access

T1189 Drive-by Compromise; T1195.002 Compromise Software Supply Chain

Resource Development

T1587.004 Exploits; T1588.005 Exploits; T1588.006 Vulnerabilities

Reconnaissance

T1592.002 Software

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Bad Epoll (CVE-2026-46242)

  • Linux Kernel Community — Linux Kernel (mainline & LTS)
    Vulnerable versions: v6.4; v6.5; v6.6; v6.7; v6.8; v6.9; v6.10; v6.11; v6.12 (prior to 6.12.67 backport)
    Fixed in: v6.12.67+ (backport of commit a6dc643c6931); mainline post-2026-04-24
  • Google — Android (AOSP, devices running common kernel v6.4+)
    Vulnerable versions: Android devices built on common kernel v6.4 or newer
    Fixed in: Devices on Linux kernel v6.1 or earlier are unaffected (e.g. Pixel 8)

Remediation for Bad Epoll (CVE-2026-46242)

Patches

  • Upstream mainline fix: commit a6dc643c6931 (landed 2026-04-24)
  • Await and apply distribution-specific kernel package updates from Ubuntu, Debian, RHEL, SUSE, and other vendors
  • Apply relevant Android Security Bulletin / AOSP patches for devices running common kernel v6.4+

Immediate actions

  • Apply the upstream Linux kernel fix (commit a6dc643c6931) or the corresponding distribution backport as soon as it is released
  • Prioritize patching multi-tenant Linux hosts, shared servers, and container hosts where local users are untrusted
  • Increase monitoring of privilege-escalation indicators until patched: unexpected setuid execution, unusual /proc access, and processes rapidly changing effective UID

Workarounds

  • None available -- epoll cannot be disabled without breaking core OS and browser functionality
  • Partial mitigation only: KASLR and SLUB randomization can disrupt the exploit's dependency on predictable heap layout, but do not close the underlying race condition

Longer-term hardening

  • Deploy runtime kernel-level monitoring (e.g. Falco) tuned for privilege-escalation and container-escape behavior
  • Enable and enforce KASLR and SLUB/heap randomization fleet-wide to raise the bar against heap-layout-dependent UAF exploitation techniques
  • Track kernel CVE patch lineage carefully -- verify a fix fully closes a reported issue rather than assuming a single patch resolved a multi-bug commit
  • Treat AI-assisted code review (e.g. Mythos-class tooling) as a complement to, not a replacement for, manual security review of concurrency-sensitive kernel code

CVEs associated with Bad Epoll (CVE-2026-46242)

CVE-2026-46242, CVE-2026-43074

Weaknesses (CWE) in Bad Epoll (CVE-2026-46242)

CWE-416, CWE-362

Timeline of Bad Epoll (CVE-2026-46242)

  • Commit 58c9b016e128 merges into mainline Linux, rewriting roughly 2,500 lines of epoll code and introducing two latent race conditions in ep_remove() -- one later cataloged as CVE-2026-43074, the other as Bad Epoll / CVE-2026-46242.
  • Jaeyoung Chung, a PhD student in the CompSec Lab at Seoul National University (advised by Prof. Byoungyoung Lee), first reports the underlying epoll race-condition issue to Linux kernel maintainers, ahead of and independent from Anthropic Mythos's later CVE-2026-43074 finding.
  • A fix for CVE-2026-43074 -- discovered by Anthropic's Claude Mythos (Preview) AI model under Project Glasswing -- merges into mainline. The patch closes only one of the two race conditions and inadvertently removes the KASAN signal that might otherwise have surfaced the second bug.
  • Anthropic publicly announces Claude Mythos (Preview) and Project Glasswing, disclosing that the model autonomously discovered CVE-2026-43074 and other zero-days during automated kernel and OS/browser code review.
  • Chung determines the 2 April patch for CVE-2026-43074 did not close the remaining race condition and re-reports the residual flaw (later named Bad Epoll) to kernel maintainers, alongside a working exploit submitted to Google's kernelCTF program.
  • The correct upstream fix for Bad Epoll lands as commit a6dc643c6931, two days after Chung's re-report and roughly two months after Chung's original 17 February report to maintainers.
  • Anthropic publishes an initial Project Glasswing program update, reporting that partner organizations collectively surfaced over 10,000 high- or critical-severity vulnerabilities in roughly one month using Mythos Preview, and disclosing a separate now-patched wolfSSL certificate-forgery vulnerability (CVE-2026-5194) found by the same model.
  • As of public disclosure, CVE-2026-46242 does not appear on CISA's Known Exploited Vulnerabilities catalog and no confirmed in-the-wild exploitation has been reported.
  • Cyber Security News publishes the first public writeup of Bad Epoll (CVE-2026-46242); The Hacker News, TechTimes, LatestHackingNews, and other outlets follow with additional technical detail the same day.
  • Jaeyoung Chung's exploit proof-of-concept and technical writeup, demonstrating ~99% reliable root escalation, become publicly available on GitHub (J-jaeyoung/bad-epoll).

Sources cited for Bad Epoll (CVE-2026-46242)

Threats related to Bad Epoll (CVE-2026-46242)

Detection coverage for TL-2026-1105

As of 2026-07-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1105 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats