Bad Epoll: Linux Kernel Flaw Gives Any Local User Root Access, Exploit Is 99% Reliable

A severe Linux kernel vulnerability dubbed Bad Epoll (CVE-2026-46242) gives an ordinary local user — one with no special privileges — the ability to take complete root control of a machine. A public exploit achieves roughly 99% reliability on tested targets, making this one of the most practical local privilege-escalation flaws disclosed in years.

How the Exploit Works

Bad Epoll is a use-after-free bug in the kernel's epoll subsystem, specifically inside the ep_remove() function. The flaw exploits a race condition: when a file is closed and two parts of the kernel attempt to clean up the same internal eventpoll object simultaneously, one path frees the memory while the other is still writing into it. That narrow collision corrupts kernel memory and creates the foothold an attacker needs to climb from an unprivileged account to root.

The race window spans only about six instructions — tight enough that most automated auditing tools, including AI-assisted code analysis, failed to catch it. Security researcher Jaeyoung Chung, who discovered the flaw while working through Google's kernelCTF program, noted that a related bug in the same 2,500-line epoll code path (CVE-2026-43074) had been found earlier by Anthropic's Mythos AI model. Bad Epoll was the second, subtler flaw that Mythos missed.

What's at Risk

Any system running Linux kernel v6.4 or later is affected — which covers the vast majority of modern Linux servers and desktops, as well as Android devices. Researchers also confirmed the vulnerability is reachable from inside Chrome's renderer sandbox, meaning a compromised browser tab could potentially be leveraged as a stepping stone to full system compromise.

Because the flaw requires only local access — not remote code execution — the most immediate threat is insider attacks, shared hosting environments, and container escapes where a user already has a foothold on the machine.

Patch Status: Available, but Not Widely Deployed

An upstream Linux kernel fix landed in the mainline on April 24, after a first patch attempt proved incomplete. Despite that, the majority of Linux distributions — including many enterprise Linux variants — had not shipped the backported fix as of this reporting. Administrators should check their distribution's security advisories and apply available kernel updates immediately. There is no configuration workaround because epoll cannot be disabled.

Android vendors are expected to include the fix in upcoming monthly security bulletins, but the update rollout will vary by device and manufacturer.

What to Do

System administrators should prioritize applying kernel updates from their distribution's security channels. Organizations running shared compute infrastructure — cloud VMs, containers, managed Linux environments — face the highest immediate risk. Until patching is complete, limiting shell access to trusted users significantly reduces exposure.

The exploit is now public, removing any grace period. This is not a theoretical risk.

The vulnerability was first reported by CyberSecurityNews and confirmed by The Hacker News.