{"id":182539,"date":"2026-07-08T10:54:16","date_gmt":"2026-07-08T08:54:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/bad-epoll-v-linux-i-android-nashli-uyazvimost-dlya-polucheniya-root-dostupa"},"modified":"2026-07-08T10:54:16","modified_gmt":"2026-07-08T08:54:16","slug":"bad-epoll-v-linux-i-android-nashli-uyazvimost-dlya-polucheniya-root-dostupa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/bad-epoll-v-linux-i-android-nashli-uyazvimost-dlya-polucheniya-root-dostupa","title":{"rendered":"Bad Epoll: a vulnerability was found in Linux and Android that allows for root access","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
1 <\/p>\n

A vulnerability has been discovered in the Linux kernel Bad Epoll<\/strong>, registered as CVE-2026-46242<\/a>. It enables a regular local user without special permissions to escalate privileges to root. According to the researcher Jeong Chon, the issue affects not only Linux desktops and servers but also some Android devices running newer kernel versions \u2014 this is specifically highlighted in the description of Bad Epoll<\/a>.<\/p>\n

<\/noindex> <\/p>\n

The flaw resides in the epoll<\/strong> subsystem \u2014 the standard Linux mechanism for monitoring multiple file descriptors, network connections, and input\/output events. Such mechanisms are heavily utilized by servers, browsers, and network services, making it infeasible to simply disable epoll. In the technical analysis<\/a> the vulnerability is described as a race condition leading to use-after-free<\/strong>: during the simultaneous closure of related epoll objects, one thread frees the internal structures while another continues to access them.<\/p>\n

<\/noindex> <\/p>\n

Specifically, the issue arises when one epoll descriptor monitors another, and both descriptors are closed in parallel. After the call to __ep_remove(), the field file->f_ep is temporarily zeroed out, and the competing __fput() may decide that additional cleanup is no longer necessary. As a result, the struct eventpoll object or its associated struct file is freed too early, yet the code continues to work with pointers to already freed memory. This is what gives the attacker a primitive for kernel memory corruption.<\/p>\n

<\/p>\n

No additional capabilities are required for the attack, nor are user namespaces needed \u2014 the presence of CONFIG_EPOLL is sufficient, making this issue particularly troublesome for standard Linux systems. According to the preliminary report from the researcher<\/a>, the bug was introduced into the kernel by the commit 58c9b016e128<\/a> in 2023, and was fixed by the commit a6dc643c693<\/a>.<\/p>\n

<\/noindex> <\/p>\n

Despite the very narrow race window, the researcher prepared a working exploit for Google kernelCTF. In the exploitation description<\/a> it shows how the bug is turned into an 8-byte write to the freed structure, leading to a kernel memory leak through \/proc\/self\/fdinfo, intercepting file->f_op->poll, and a ROP chain for obtaining root privileges. For the target lts-6.12.67, a reliability of about 99% is claimed, for COS \u2014 about 98%; the Android exploit is still reportedly in progress.<\/p>\n

<\/noindex> <\/p>\n

Affected are kernels based on the branch 6.4 and newer<\/strong>, if the fix has not been carried over to them. Older Android devices with kernels 6.1, including Pixel 8 and similar models, the author considers invulnerable<\/a>. Users and administrators have only one proper option for protection \u2014 to install the kernel update from their distribution or device vendor.<\/p>\n

<\/noindex><\/p>\n

Source: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

1 \u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Bad Epoll, \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u043a\u0430\u043a CVE-2026-46242. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u044b\u0447\u043d\u043e\u043c\u0443 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u0431\u0435\u0437 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0430\u0432 \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e root. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0430\u0432\u0442\u043e\u0440\u0430 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0414\u0436\u044d\u0451\u043d\u0430 \u0427\u043e\u043d\u0430, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e Linux-\u0434\u0435\u0441\u043a\u0442\u043e\u043f\u044b \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u044b, \u043d\u043e \u0438 \u0447\u0430\u0441\u0442\u044c Android-\u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0430 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u044f\u0434\u0440\u0430 \u2014 \u044d\u0442\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u043f\u043e\u0434\u0447\u0451\u0440\u043a\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0438 Bad Epoll. \u041e\u0448\u0438\u0431\u043a\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182539","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bad Epoll: vulnerability discovered in Linux and Android for obtaining root access | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/bad-epoll-v-linux-i-android-nashli-uyazvimost-dlya-polucheniya-root-dostupa","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Bad Epoll: \u0432 Linux \u0438 Android \u043d\u0430\u0448\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f root-\u0434\u043e\u0441\u0442\u0443\u043f\u0430 | ProHoster","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/bad-epoll-v-linux-i-android-nashli-uyazvimost-dlya-polucheniya-root-dostupa","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-07-08T08:54:16+00:00","article:modified_time":"2026-07-08T08:54:16+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182539","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:07","updated":"2026-08-05 12:22:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/182539","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=182539"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/182539\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=182539"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=182539"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=182539"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}