"Bad Epoll" Kernel Flaw Gives Attackers Root Access on Linux and Android

Linux "Bad Epoll" vulnerability lets unprivileged users reach root, and a working exploit is public. Patch servers and devices now.

By Content Team

Jul 5, 2026

ON THIS PAGE

A newly disclosed Linux kernel vulnerability called "Bad Epoll" (CVE-2026-46242) lets unprivileged local users gain full root access on Linux servers, desktops and Android devices. The flaw is a race condition and use-after-free in the kernel's epoll subsystem — a core component that can't be disabled without breaking the OS.

Researcher Jaeyoung Chung found and exploited the bug, submitting it to Google's kernelCTF program, which pays $71,337+ for working kernel exploits. The exploit hits roughly 99% reliability despite a race window of about six instructions, and it's reachable from inside Chrome's renderer sandbox — meaning it can be chained with a renderer exploit for full kernel code execution.

There's no evidence of exploitation in the wild, but full technical details and working exploit code are now public, so that window won't stay open. Upstream and distribution patches are available — apply them. Worth checking you're on the final fix rather than an early one: the first patch attempts were incomplete, and a correct fix only landed nearly two months after disclosure.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?