# Bad Epoll (CVE-2026-46242): Use-After-Free Zero-Day in Linux Kernel epoll Subsystem Enables Root Privilege Escalation

> A zero-day use-after-free vulnerability (CVE-2026-46242), dubbed 'Bad Epoll,' in the Linux kernel's epoll subsystem (ep_remove()) lets an unprivileged local user win a ~6-instruction race to corrupt kernel memory and escalate to root on Linux servers, desktops, and Android devices running kernel v6.4+. Researcher Jaeyoung Chung's kernelCTF-submitted exploit reaches root with ~99% reliability and is even triggerable from inside Chrome's sandboxed renderer process; the kernel maintainers' first patch attempt (for a related, Anthropic Mythos-discovered CVE-2026-43074) was incomplete, and a correct fix did not land until nearly two months after initial disclosure.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-07-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1105
- **ID:** TL-2026-1105
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-46242, CVE-2026-43074

## Description

Bad Epoll (CVE-2026-46242) is a use-after-free (UAF) vulnerability in the Linux kernel's epoll subsystem, specifically in the ep_remove() cleanup path. The function clears file->f_ep under file->f_lock but continues operating on the file object during hlist_del_rcu() and spin_unlock(). A concurrent __fput() call can observe a NULL f_ep value, skip eventpoll_release_file(), and proceed directly into f_op->release, freeing an active struct eventpoll object that is still in use elsewhere in the kernel. The race window is only about six machine instructions wide, but researcher Jaeyoung Chung's exploit reliably wins it using a timer-interrupt-based widening technique combined with a retry loop that never crashes the target kernel.

The bug and a sibling race condition (CVE-2026-43074) were both introduced by a single commit, 58c9b016e128, merged into mainline Linux on 2023-04-08 as part of a roughly 2,500-line change to the epoll subsystem. Jaeyoung Chung -- a PhD student in the CompSec Lab at Seoul National University, advised by Prof. Byoungyoung Lee -- first reported the underlying epoll race-condition issue to kernel maintainers on 2026-02-17. Independently, the first of the two races (CVE-2026-43074) was discovered by Anthropic's Claude Mythos (Preview) AI model during automated kernel code review under Project Glasswing (publicly announced 2026-04-07), and was patched in mainline on 2026-04-02. That patch, however, addressed only one of the two race conditions and had the side effect of removing the KASAN signal that might otherwise have surfaced the second, harder-to-spot bug -- the flaw Mythos itself did not catch, likely due to its narrow timing window and low probability of triggering KASAN. Chung determined the 2 April patch was incomplete and re-reported the remaining race (subsequently named Bad Epoll) on 2026-04-22, and the correct upstream fix landed two days later as commit a6dc643c6931 -- nearly two months after Chung's original report to kernel maintainers.

Chung's working exploit, submitted as a zero-day to Google's kernelCTF program (rewarded at $71,337 or more), converts the initial 8-byte UAF write into a full use-after-free on a struct file object via a cross-cache attack. It then achieves an arbitrary kernel memory read by dangling a struct file reference and reading it back out through /proc/self/fdinfo, using the leak to defeat KASLR before hijacking control flow with a ROP chain to obtain a root shell. The technique uses four linked epoll file descriptors arranged in two pairs -- one pair to repeatedly trigger the race, the other to serve as the corrupted victim object -- and reaches root reliably without ever crashing the kernel: approximately 99% reliability on the kernelCTF LTS-6.12.67 target and 98% on the COS-121 target.

Because epoll is used pervasively across Linux user space (including inside browser sandboxes), Bad Epoll is exploitable from within Chrome's sandboxed renderer process; an attacker who already has renderer-level code execution (e.g., via a browser memory-corruption bug or malicious web content) could chain Bad Epoll to escape the sandbox entirely and escalate to root on the host. The bug affects Linux kernel v6.4 and later -- it is absent from v6.1-based kernel trees, meaning devices such as the Pixel 8 that ship v6.1-based kernels are not affected, while most modern Linux servers, desktops, and newer Android devices running kernel v6.4+ are exposed until patched. There is no workaround: epoll cannot be disabled without breaking core OS and browser functionality. Enabling KASLR and SLUB/heap randomization can disrupt the exploit's dependency on predictable heap layout as a partial mitigation, but administrators must apply the upstream fix or an equivalent distribution backport to fully remediate. As of the 2026-07-04 public disclosure, CVE-2026-46242 does not appear on CISA's Known Exploited Vulnerabilities catalog and there is no confirmed evidence of in-the-wild exploitation; the primary near-term risk is that the now-public, highly reliable PoC lowers the bar for any actor targeting unpatched multi-tenant Linux infrastructure, CI/build systems, or Android devices. Notably, Chung's independent report predates Anthropic's public Project Glasswing update (2026-05-22), in which partner organizations reported collectively surfacing over 10,000 high-or-critical-severity vulnerabilities within roughly one month using Mythos Preview -- illustrating that large-scale AI-assisted kernel auditing and dedicated human research are now surfacing overlapping classes of concurrency bugs in parallel, with neither modality alone sufficient to fully close a multi-bug commit.

## MITRE ATT&CK

- T1592.002 Software
- T1588.005 Exploits
- T1588.006 Vulnerabilities
- T1587.004 Exploits
- T1189 Drive-by Compromise
- T1195.002 Compromise Software Supply Chain
- T1203 Exploitation for Client Execution
- T1059.004 Unix Shell
- T1136.001 Local Account
- T1542 Pre-OS Boot
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1548.001 Setuid and Setgid
- T1548.003 Sudo and Sudo Caching
- T1211 Exploitation for Stealth
- T1078 Valid Accounts
- T1685 Disable or Modify Tools
- T1003.008 /etc/passwd and /etc/shadow
- T1082 System Information Discovery
- T1057 Process Discovery
- T1518.001 Security Software Discovery

## Sources

- [New "Bad Epoll" 0-Day Vulnerability Allows Root Access on Linux Servers and Android Devices](https://cybersecuritynews.com/bad-epoll-0-day-vulnerability/)
- [New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android](https://thehackernews.com/2026/07/new-bad-epoll-linux-kernel-flaw-lets.html)
- [Bad Epoll: Kernel Race Bug Beats AI Auditing, Hits 99% Root Exploit Rate](https://www.techtimes.com/articles/319686/20260704/bad-epoll-kernel-race-bug-beats-ai-auditing-hits-99-root-exploit-rate.htm)
- ["Bad Epoll" Linux Kernel Bug Lets Any User Grab Root](https://latesthackingnews.com/2026/07/04/bad-epoll-vulnerability/)
- [GitHub - J-jaeyoung/bad-epoll (exploit PoC and technical writeup)](https://github.com/J-jaeyoung/bad-epoll)
- [Assessing Claude Mythos Preview's cybersecurity capabilities](https://red.anthropic.com/2026/mythos-preview/)
- [Project Glasswing: An initial update](https://www.anthropic.com/research/glasswing-initial-update)
- [CVE-2026-46242 'Bad Epoll': Unprivileged Root Escalation in Linux Kernel Demands Immediate Patching](https://news.shield53.com/cve-2026-46242-bad-epoll-unprivileged-root-escalation-in-linux-kernel-demands-immediate-patching/)
- [NVD - CVE-2026-46242](https://nvd.nist.gov/vuln/detail/CVE-2026-46242)
- [New "Bad Epoll" 0-Day Vulnerability Allows Root Access on Linux Servers and Android Devices (Cryptika)](https://www.cryptika.com/new-bad-epoll-0-day-vulnerability-allows-root-access-on-linux-servers-and-android-devices/)
- [Linux 'Bad Epoll' Bug Grants Any User Root Access](https://bitnewsbot.com/linux-bad-epoll-bug-grants-any-user/)
- [New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android (HendryAdrian repost)](https://www.hendryadrian.com/new-bad-epoll-linux-kernel-flaw-lets-unprivileged-users-gain-root-hits-android/)
- [Bad Epoll CVE-2026-46242: Patch Linux Kernel Root Flaw](https://howtofix.guide/bad-epoll-cve-2026-46242-linux-root/)
- [Why Is the "Bad Epoll" Linux Kernel Vulnerability Only Making Headlines Now, in Early July?](https://pbxscience.com/why-is-the-bad-epoll-linux-kernel-vulnerability-only-making-headlines-now-in-early-july/)
- ["Bad Epoll" permite a los usuarios sin privilegios obtener root en Linux y Android](https://blog.segu-info.com.ar/2026/07/bad-epoll-permite-los-usuarios-sin.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1105