A newly disclosed Linux vulnerability, dubbed “Bad Epoll,” has made its way into the public sphere with a proof-of-concept (PoC) exploit that could grant unprivileged processes root access on desktops, servers, and even Android phones. The bug, assigned a CVSS score of 7.8 and tracked as CVE-2026-46242, exploits a race-condition use-after-free issue in the Linux kernel’s I/O event notification facility.
The flaw was discovered by Jaeyoung Chung, a researcher from Seoul National University’s Computer Security Lab, who reported it to Google’s kernelCTF program earlier this year. The vulnerability is believed to have been introduced in 2023 as part of a commit that also addressed another race condition in the epoll code, CVE-2026-43074. Interestingly, Mythos, the researcher who found the first bug, likely missed Bad Epoll because it doesn’t trigger KASAN (Kernel Address Sanitizer), the Linux kernel’s dynamic memory error detector.
The PoC exploit published by Chung demonstrates how an attacker can leverage Bad Epoll to leak kernel memory and hijack an indirect call, ultimately obtaining root privileges via a Return-Oriented Programming (ROP) chain. The vulnerability affects Linux distributions based on kernel version 6.4 or newer, which includes popular distros like Ubuntu and Debian. Furthermore, the bug has also been confirmed to exist on Pixel 10 devices running kernel version 6.6.
Bad Epoll is a complex issue that required considerable effort from the maintainers to fix correctly. As Chung notes, “The maintainers’ first patch did not fully fix the issue, and a correct patch landed only two months after the bug was first reported. That is a long time for a kernel that usually handles security issues with urgency.” This highlights the challenges of addressing complex vulnerabilities like Bad Epoll.
For Linux users, this vulnerability serves as a stark reminder of the importance of timely kernel updates. Given the severity of the issue and the potential consequences of exploitation, it’s essential to apply the latest patches as soon as possible. Additionally, system administrators should review their kernel configurations to ensure they’re running on a version that addresses CVE-2026-46242.
In conclusion, the Bad Epoll vulnerability underscores the ongoing need for vigilance in the Linux community. By understanding and addressing complex vulnerabilities like this one, we can work towards creating a more secure ecosystem for users and administrators alike.
Source: SecurityWeek — 2026-07-06