cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

PoC Exploit Released for Linux Bad Epoll Root-Access Vulnerability

· Original article ↗

Summary

A public PoC for Linux kernel vulnerability CVE-2026-46242, Bad Epoll, can leak kernel memory and gain root privileges. Linux distributions based on kernel 6.4 or newer and Pixel 10 devices running kernel 6.6 are affected.

Key points

  • CVE-2026-46242 is a race-condition use-after-free bug in the Linux kernel’s epoll file-release path.
  • The race can occur when two eventpoll lists are closed simultaneously while one monitors the other, allowing one to free an object that the other continues to write to.
  • Researcher Jaeyoung Chung published a PoC that reportedly leaks kernel memory, hijacks an indirect call, and uses a ROP chain to gain root privileges.
  • Linux distributions based on kernel 6.4 or newer are affected; the flaw was also confirmed on Pixel 10 devices running kernel 6.6.
  • Chung reported the flaw to Google kernelCTF as a zero-day submission. The article says the maintainers’ first patch was incomplete and a correct patch landed two months after the bug was first reported.
  • Bad Epoll was introduced in 2023 in a commit that also introduced CVE-2026-43074; the article says Bad Epoll does not trigger KASAN when CVE-2026-43074 is fixed.

Article Details

Vulnerability Types
  • Race condition
  • Use-after-free
Severity
CVSS 7.8
Affected Versions
  • Linux kernel 6.4 and newer
  • Pixel 10 (kernel 6.6)
Exploitation Status
unknown
Exploit Availability
public_poc
Patch Status
available

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe published PoC exploits Bad Epoll to obtain root privileges from an unprivileged process.

CVE

CVE-2026-43074Bad Epoll was introduced in 2023 in a commit that also introduced CVE-2026-43074, another race condition in the epoll code that was found by Anthropic’s Mythos.CVE-2026-46242The security defect, tracked as CVE-2026-46242 (CVSS score of 7.8) and referred to as Bad Epoll, is described as a race-condition use-after-free bug in epoll, the Linux kernel’s I/O event notification facility.

People

Jaeyoung ChungSeoul National University Computer Security Lab researcher who discovered Bad Epoll, reported it to Google kernelCTF as a zero-day submission, and published a PoC exploit.

Products

Google Pixel 10Bad Epoll was also confirmed on Pixel 10 devices, which are running kernel version 6.6.LinuxTechnical details and proof-of-concept (PoC) code targeting a recent Linux kernel vulnerability that could allow unprivileged processes to gain root privileges on desktops, servers, and Android phones are now public.

Tools

MythosBad Epoll was introduced in 2023 in a commit that also introduced CVE-2026-43074, another race condition in the epoll code that was found by Anthropic’s Mythos.

Related Articles