"Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242) Enables Unprivileged Root Escalation, Impacts Android — Threadlinqs Intelligence
As of 2026-07-05, "Bad Epoll" Linux Kernel Use-After-Free (CVE-2026-46242) Enables Unprivileged Root Escalation, Impacts Android is a high-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-1106 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: VULNERABILITY
A race-condition use-after-free vulnerability (CVE-2026-46242, "Bad Epoll") in the Linux kernel's epoll subsystem (ep_remove()/ep_remove_file()) allows an unprivileged local user to escalate to root
CVE-2026-46242, dubbed "Bad Epoll," is a use-after-free (UAF) race condition in the Linux kernel's epoll/eventpoll subsystem, the core I/O event-notification interface used throughout the networking stack, by browsers, and by virtually every Linux and Android userspace process. The bug lives in ep_remove(), which clears the file->f_ep pointer under file->f_lock but continues operating on the file object inside the same critical section during hlist_del_rcu() and spin_unlock(). A concurrent __fput() call running on another CPU can observe the transient NULL value, skip the proper eventpoll_release_file() cleanup path, and instead take a fast path through f_op->release/eventpoll_release(), freeing a struct eventpoll that ep_remove() is still using.
Because struct file is marked SLAB_TYPESAFE_BY_RCU, the freed slot can be immediately recycled by alloc_empty_file(), letting an attacker perform a cross-cache attack: an 8-byte UAF write is converted into a full use-after-free on a struct file object, giving the attacker control of the file's contents. Jaeyoung Chung's public PoC groups four epoll file descriptors into two pairs configured to watch each other; closing one pair near-simultaneously repeatedly re-triggers the race (a window only about six machine instructions wide, further widened using a timer-interrupt technique) while the second pair serves as the victim object. From the corrupted file object, the exploit pivots to an arbitrary kernel memory read primitive via /proc/self/fdinfo, then hijacks kernel control flow and executes a ROP (return-oriented-programming) chain to pop a root shell. The exploit loops without crashing the kernel and reached 99% reliability against Google kernelCTF's LTS-6.12.67 target and 98% reliability against the COS-121 (Container-Optimized OS) target.
Bad Epoll and a related, earlier-patched race condition (CVE-2026-43074, found by Anthropic's Mythos AI model as part of Anthropic's broader open-source vulnerability-hunting effort and the Project Glasswing disclosure coalition) both trace back to a single upstream commit, 58c9b016e128 (merged 2023-04-08), which quietly introduced two separate concurrency bugs into roughly 2,500 lines of epoll code. Mythos caught CVE-2026-43074 but missed Bad Epoll in the same code path. Jaeyoung Chung (PhD student, CompSec Lab, Seoul National University) first reported Bad Epoll to Linux kernel maintainers on 2026-02-17. When the CVE-2026-43074 fix landed in mainline on 2026-04-02, it addressed only that bug and inadvertently removed the only runtime KASAN signal that a second, unpatched bug remained in the same code path — meaning the AI-discovered fix silently masked the human-discovered one. After confirming Bad Epoll was still unfixed, Chung re-reported the remaining flaw to maintainers on 2026-04-22; a correct, complete fix (commit a6dc643c6931) landed upstream just two days later, on 2026-04-24 — roughly 66 days after Chung's initial report.
Bad Epoll affects mainline Linux from v6.4 onward and any distribution kernel derived from that baseline without the backported fix, including RHEL, Ubuntu, Debian (non-bullseye/bookworm branches), and SUSE. Debian bullseye and bookworm are confirmed unaffected because the vulnerable code path is absent. On Android, devices running 6.6-series kernels and newer — including current Pixel hardware — are confirmed vulnerable; older 6.1-based kernels (e.g., Pixel 8) predate the 2023 commit and are not affected. Notably, the PoC can be triggered from inside Chrome's sandboxed renderer process, a scenario that blocks almost every other kernel bug; an attacker who already has renderer code execution (e.g., via a malicious web page) could chain Bad Epoll to escape the browser sandbox entirely and gain kernel/root-level control. Because epoll is a core, non-optional kernel subsystem, there is no workaround — the only mitigation is applying the upstream patch or a distribution/Android security bulletin backport. As of source
Target sectors: technology, cloudhosting, government administration, finance, telecoms, education, managedserviceproviders
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2026-46242, CVE-2026-43074, T1592, T1587, T1588, T1189, T1203, T1068, T1611, T1014, T1211, T1082