A critical vulnerability in Linux’s Epoll feature has been made public, allowing attackers to gain root access on vulnerable systems. The “Bad Epoll” flaw, discovered by Jaeyoung Chung of Seoul National University’s Computer Security Lab, can be exploited using a proof-of-concept (PoC) code released by the researcher.
The vulnerability affects Linux distributions based on kernel version 6.4 or newer, as well as Android devices running kernel version 6.6. This includes desktops, servers, and mobile phones, making it a significant concern for system administrators and users alike.
So, what exactly is Bad Epoll? In simple terms, Epoll is a Linux feature that allows programs to efficiently handle multiple file descriptors by polling only those that are ready to receive data. However, in this case, the flaw arises from a “close-vs-close” race condition in the Epoll’s file-release path. When an Epoll instance monitors another and both are closed simultaneously, one process frees an object while the other continues to write to it, leading to use-after-free.
The researcher notes that Bad Epoll was introduced in 2023 as part of a commit that also fixed another race condition in the Epoll code (CVE-2026-43074). However, due to the way Linux kernel’s dynamic memory error detector, KASAN (Kernel Address Sanitizer), works, Mythos likely missed this flaw initially. The maintainers’ first patch did not fully fix the issue, and a correct patch landed only two months after the bug was first reported.
Chung’s PoC exploit leverages the Bad Epoll vulnerability to leak kernel memory and hijack an indirect call to control the CPU’s instruction pointer register. This allows attackers to obtain root privileges via a Return-Oriented Programming (ROP) chain. The researcher emphasizes that this is not just a theoretical risk, as the flaw can be exploited in real-world scenarios.
The release of the PoC exploit code raises concerns about potential exploitation by malicious actors. System administrators should immediately assess their Linux distributions and Android devices for vulnerability to Bad Epoll. If found vulnerable, patches should be applied promptly to prevent unauthorized access.
While the CVSS score of 7.8 is relatively high, it’s essential to note that not all systems are equally affected. However, with the release of the PoC exploit code, the risk of exploitation increases significantly. It’s crucial for system administrators and users to stay vigilant and take proactive measures to protect their systems from this vulnerability.
In light of this discovery, it’s essential to emphasize the importance of regular kernel updates and patching. This is particularly critical for Linux distributions based on kernel version 6.4 or newer. Additionally, developers should consider the implications of introducing new features like Epoll and ensure they are thoroughly tested for potential vulnerabilities.
As a practical takeaway, system administrators and users should immediately review their systems’ vulnerability status and apply patches as soon as possible to prevent exploitation by malicious actors. Furthermore, regular kernel updates and monitoring for potential vulnerabilities will help mitigate risks associated with this flaw.
Source: SecurityWeek — 2026-07-06