A vulnerability has been discovered in the Linux kernel Bad Epoll, registered as CVE-2026-46242. It enables a regular local user without special permissions to escalate privileges to root. According to the researcher Jeong Chon, the issue affects not only Linux desktops and servers but also some Android devices running newer kernel versions — this is specifically highlighted in the description of Bad Epoll.
The flaw resides in the epoll subsystem — the standard Linux mechanism for monitoring multiple file descriptors, network connections, and input/output events. Such mechanisms are heavily utilized by servers, browsers, and network services, making it infeasible to simply disable epoll. In the technical analysis the vulnerability is described as a race condition leading to use-after-free: during the simultaneous closure of related epoll objects, one thread frees the internal structures while another continues to access them.
Specifically, the issue arises when one epoll descriptor monitors another, and both descriptors are closed in parallel. After the call to __ep_remove(), the field file->f_ep is temporarily zeroed out, and the competing __fput() may decide that additional cleanup is no longer necessary. As a result, the struct eventpoll object or its associated struct file is freed too early, yet the code continues to work with pointers to already freed memory. This is what gives the attacker a primitive for kernel memory corruption.
No additional capabilities are required for the attack, nor are user namespaces needed — the presence of CONFIG_EPOLL is sufficient, making this issue particularly troublesome for standard Linux systems. According to the preliminary report from the researcher, the bug was introduced into the kernel by the commit 58c9b016e128 in 2023, and was fixed by the commit a6dc643c693.
Despite the very narrow race window, the researcher prepared a working exploit for Google kernelCTF. In the exploitation description it shows how the bug is turned into an 8-byte write to the freed structure, leading to a kernel memory leak through /proc/self/fdinfo, intercepting file->f_op->poll, and a ROP chain for obtaining root privileges. For the target lts-6.12.67, a reliability of about 99% is claimed, for COS — about 98%; the Android exploit is still reportedly in progress.
Affected are kernels based on the branch 6.4 and newer, if the fix has not been carried over to them. Older Android devices with kernels 6.1, including Pixel 8 and similar models, the author considers invulnerable. Users and administrators have only one proper option for protection — to install the kernel update from their distribution or device vendor.
Source: linux.org.ru
