"Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242) Enables Unprivileged Root Escalation, Impacts Android

"Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242) (TL-2026-1106), also tracked as Bad Epoll, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-07-05. It has no confirmed attribution, affects Linux Kernel Organization Linux Kernel (mainline), references 2 CVEs (CVE-2026-46242, CVE-2026-43074), maps to 16 MITRE ATT&CK techniques (T1003, T1005, T1014), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-1106

Threat ID
TL-2026-1106
Also known as
Bad Epoll
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-05
Last reviewed
2026-07-05
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, cloudhosting, government administration, finance, telecoms, education, managedserviceproviders
Target regions
Global
Detection rules
9
Indicators of compromise
27

Malware and tooling in "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242)

Malware and tooling: Google kernelCTF, KASAN (Kernel Address Sanitizer), bad-epoll PoC exploit (J-jaeyoung/bad-epoll)

A race-condition use-after-free vulnerability (CVE-2026-46242, "Bad Epoll") in the Linux kernel's epoll subsystem (ep_remove()/ep_remove_file()) allows an unprivileged local user to escalate to root on Linux and Android devices. Researcher Jaeyoung Chung built a working exploit reaching ~99% reliability and submitted it to Google's kernelCTF program; no in-the-wild exploitation has been confirmed and a corrected upstream patch has since landed.

How "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242) works

CVE-2026-46242, dubbed "Bad Epoll," is a use-after-free (UAF) race condition in the Linux kernel's epoll/eventpoll subsystem, the core I/O event-notification interface used throughout the networking stack, by browsers, and by virtually every Linux and Android userspace process. The bug lives in ep_remove(), which clears the file->f_ep pointer under file->f_lock but continues operating on the file object inside the same critical section during hlist_del_rcu() and spin_unlock(). A concurrent __fput() call running on another CPU can observe the transient NULL value, skip the proper eventpoll_release_file() cleanup path, and instead take a fast path through f_op->release/eventpoll_release(), freeing a struct eventpoll that ep_remove() is still using.

Because struct file is marked SLAB_TYPESAFE_BY_RCU, the freed slot can be immediately recycled by alloc_empty_file(), letting an attacker perform a cross-cache attack: an 8-byte UAF write is converted into a full use-after-free on a struct file object, giving the attacker control of the file's contents. Jaeyoung Chung's public PoC groups four epoll file descriptors into two pairs configured to watch each other; closing one pair near-simultaneously repeatedly re-triggers the race (a window only about six machine instructions wide, further widened using a timer-interrupt technique) while the second pair serves as the victim object. From the corrupted file object, the exploit pivots to an arbitrary kernel memory read primitive via /proc/self/fdinfo, then hijacks kernel control flow and executes a ROP (return-oriented-programming) chain to pop a root shell. The exploit loops without crashing the kernel and reached 99% reliability against Google kernelCTF's LTS-6.12.67 target and 98% reliability against the COS-121 (Container-Optimized OS) target.

Bad Epoll and a related, earlier-patched race condition (CVE-2026-43074, found by Anthropic's Mythos AI model as part of Anthropic's broader open-source vulnerability-hunting effort and the Project Glasswing disclosure coalition) both trace back to a single upstream commit, 58c9b016e128 (merged 2023-04-08), which quietly introduced two separate concurrency bugs into roughly 2,500 lines of epoll code. Mythos caught CVE-2026-43074 but missed Bad Epoll in the same code path. Jaeyoung Chung (PhD student, CompSec Lab, Seoul National University) first reported Bad Epoll to Linux kernel maintainers on 2026-02-17. When the CVE-2026-43074 fix landed in mainline on 2026-04-02, it addressed only that bug and inadvertently removed the only runtime KASAN signal that a second, unpatched bug remained in the same code path — meaning the AI-discovered fix silently masked the human-discovered one. After confirming Bad Epoll was still unfixed, Chung re-reported the remaining flaw to maintainers on 2026-04-22; a correct, complete fix (commit a6dc643c6931) landed upstream just two days later, on 2026-04-24 — roughly 66 days after Chung's initial report.

Bad Epoll affects mainline Linux from v6.4 onward and any distribution kernel derived from that baseline without the backported fix, including RHEL, Ubuntu, Debian (non-bullseye/bookworm branches), and SUSE. Debian bullseye and bookworm are confirmed unaffected because the vulnerable code path is absent. On Android, devices running 6.6-series kernels and newer — including current Pixel hardware — are confirmed vulnerable; older 6.1-based kernels (e.g., Pixel 8) predate the 2023 commit and are not affected. Notably, the PoC can be triggered from inside Chrome's sandboxed renderer process, a scenario that blocks almost every other kernel bug; an attacker who already has renderer code execution (e.g., via a malicious web page) could chain Bad Epoll to escape the browser sandbox entirely and gain kernel/root-level control. Because epoll is a core, non-optional kernel subsystem, there is no workaround — the only mitigation is applying the upstream patch or a distribution/Android security bulletin backport. As of source publication (2026-07-04), Bad Epoll is not listed in the CISA KEV catalog, no EPSS score is available, and no in-the-wild exploitation has been confirmed; the primary near-term risk is opportunistic adoption of the public PoC on unpatched multi-tenant systems, CI/CD build runners, developer workstations, and shared hosting environments.

MITRE ATT&CK techniques used in TL-2026-1106

Credential Access

T1003 OS Credential Dumping

Collection

T1005 Data from Local System

Defense Evasion

T1014 Rootkit; T1211 Exploitation for Stealth

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Persistence

T1136 Create Account; T1543 Create or Modify System Process

Initial Access

T1189 Drive-by Compromise

Execution

T1203 Exploitation for Client Execution

Impact

T1489 Service Stop

Resource Development

T1587 Develop Capabilities; T1588 Obtain Capabilities

Reconnaissance

T1592 Gather Victim Host Information

privilege-escalation

T1611 Escape to Host

Affected products and versions in "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242)

  • Linux Kernel Organization — Linux Kernel (mainline)
    Vulnerable versions: 6.4; 6.5; 6.6; 6.7; 6.8; 6.9; 6.10; 6.11; 6.12; 6.13-pre-fix
    Fixed in: any branch with commit a6dc643c6931 backported
  • Google — Android (AOSP kernel)
    Vulnerable versions: 6.6-series and newer device kernel branches (including current Pixel hardware)
    Fixed in: kernel branches with commit a6dc643c6931 backported via Android Security Bulletin
  • Multiple — Enterprise Linux distributions (RHEL, Ubuntu, Debian, SUSE)
    Vulnerable versions: distribution kernel branches based on mainline v6.4+ without the backported fix
    Fixed in: distribution kernel security updates once backported
  • Google — kernelCTF exploit targets (LTS-6.12.67, COS-121)
    Vulnerable versions: LTS-6.12.67 (99% exploit reliability observed); COS-121 Container-Optimized OS (98% exploit reliability observed)
    Fixed in: targets rebuilt with commit a6dc643c6931

Remediation for "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242)

Patches

  • Upstream fix: commit a6dc643c6931 (landed 2026-04-24)
  • Distribution kernel security updates for RHEL, Ubuntu, Debian (non-bullseye/bookworm branches), and SUSE once each vendor issues a backport
  • Android Security Bulletin backport of commit a6dc643c6931 for 6.6-series and newer device kernels

Immediate actions

  • Apply the upstream kernel patch (commit a6dc643c6931) or your Linux distribution's backport as soon as it is available
  • Prioritize patching on multi-tenant systems, shared hosting, CI/CD build runners, and developer workstations where unprivileged local code execution is common
  • Where reboot-based patching is not immediately feasible, apply available live-patches (kpatch on RHEL, Canonical Livepatch on Ubuntu, KLP on SUSE) to close the race without downtime

Workarounds

  • None — epoll is a core, non-optional kernel subsystem used throughout the networking stack and by browsers/userspace I/O, and cannot be disabled or unloaded

Longer-term hardening

  • Track future kernel CVEs originating from the fs/eventpoll.c code path (commit 58c9b016e128) given its history of producing multiple race-condition vulnerabilities from a single 2023 change
  • Maintain automated kernel-version fleet inventory to rapidly identify hosts running vulnerable v6.4+ branches without the fix, including Android fleets on 6.6-series+ kernels
  • Treat browser renderer-sandbox escapes as a viable path to full kernel compromise on unpatched hosts when modeling defense-in-depth for endpoint and workstation security
  • When an AI-discovered patch lands in a shared code path, explicitly re-audit for sibling bugs rather than assuming the fix is complete — the CVE-2026-43074 patch masked Bad Epoll's KASAN signal for weeks

CVEs associated with "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242)

CVE-2026-46242, CVE-2026-43074

Weaknesses (CWE) in "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242)

CWE-416

Timeline of "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242)

  • Upstream commit 58c9b016e128 merges into the Linux kernel epoll code, quietly introducing two separate race conditions across ~2,500 lines of fs/eventpoll.c — later tracked as CVE-2026-43074 and CVE-2026-46242 (Bad Epoll).
  • Jaeyoung Chung (PhD student, CompSec Lab, Seoul National University) first reports the Bad Epoll race condition to Linux kernel maintainers.
  • The fix for the related CVE-2026-43074 (discovered by Anthropic's Mythos AI model) lands in mainline. The patch addresses only that bug, leaving Bad Epoll unfixed, and inadvertently removes the KASAN signal that had been the only runtime indicator a second bug remained in the same code path.
  • After confirming the 2026-04-02 patch did not close the Bad Epoll race, Jaeyoung Chung re-reports the remaining, still-unpatched flaw to Linux kernel maintainers.
  • Upstream commit a6dc643c6931 lands in mainline Linux just two days after Chung's re-report, providing the correct, complete fix for CVE-2026-46242 (Bad Epoll) — roughly 66 days after the initial 2026-02-17 report.
  • As of publication, CVE-2026-46242 is not listed in the CISA KEV catalog, no EPSS score is available, and no in-the-wild exploitation has been confirmed; risk is assessed as opportunistic PoC adoption against unpatched systems.
  • TechTimes publishes precise exploit-reliability figures from Chung's kernelCTF submission: 99% success on the LTS-6.12.67 target and 98% on the COS-121 (Container-Optimized OS) target, and details the timer-interrupt race-widening technique plus the /proc/self/fdinfo arbitrary-kernel-read and ROP-chain root-shell primitives used post-UAF.
  • Additional outlets (TechTimes, LatestHackingNews, Cryptika, Shield53, PBX Science, and others) publish follow-on technical analyses of Bad Epoll, confirming affected kernel ranges (v6.4+ mainline, Android 6.6-series+) and noting Debian bullseye/bookworm are unaffected.
  • Cyber Security News and The Hacker News publish the first public reporting on Bad Epoll (CVE-2026-46242), detailing Chung's kernelCTF submission, the $71,337+ Google bounty, the ~99%-reliable exploit, and the Chrome renderer-sandbox trigger path.

Sources cited for "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242)

Threats related to "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242)

Detection coverage for TL-2026-1106

As of 2026-07-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1106 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats