Tia N.List

Reported by 2 outlets

CVE-2026-46242 "Bad Epoll": Unprivileged Linux Kernel Race Condition Yields Root on Servers and Android Devices

hot0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
4.00 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.22 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
thehackernews.comsecurityweek.com CVE-2026-43074CVE-2026-46242 first seen 101d ago

Timeline

  1. original reporting

    CVE-2026-46242 "Bad Epoll": Unprivileged Linux Kernel Race Condition Yields Root on Servers and Android Devices

    thehackernews.com · 101d ago · July 5th, 2026

    A newly disclosed Linux kernel zero-day, tracked as CVE-2026-46242 and dubbed "Bad Epoll," enables unprivileged local users to escalate to root privileges through a race condition and use-after-free in the kernel's epoll event notification subsystem. The vulnerability affects Linux desktops, servers, and Android devices. A patch has been released but took two attempts to fully address the underlying race condition.

    Recommended action: Apply latest kernel updates. Verify patching status on Android devices through security patch level updates.

  2. update from securityweek.com

    CVE-2026-46242 "Bad Epoll" — PoC Exploit Code Now Public for Linux Kernel Root Escalation

    securityweek.com · 100d ago · July 6th, 2026

    Previously covered July 5 at disclosure. New today: Public proof-of-concept exploit released.

    Technical details and working PoC exploit code for CVE-2026-46242 (CVSS 7.8), the Linux kernel's "Bad Epoll" race-condition use-after-free vulnerability, have been publicly released by discoverer Jaeyoung Chung of Seoul National University. The PoC exploits the close-vs-close race condition in epoll's file-release path to leak kernel memory and hijack an indirect call via a ROP chain to obtain root privileges. Key technical details from the published exploit:

    • Bad Epoll was introduced in a 2023 kernel commit that also introduced CVE-2026-43074 (found by Anthropic's Mythos)

    • Mythos likely missed Bad Epoll because, with the sibling bug fixed, it doesn't trigger KASAN (Kernel Address Sanitizer)

    • The kernel maintainers' first patch did not fully fix the issue; the correct fix landed only two months after initial reporting

    • Affects Linux 6.4+; confirmed exploitable on Pixel 10 devices (kernel 6.6)

    • PoC uses memory leak to bypass KASLR, then ROP chain for privilege escalation

    Recommended action: Apply latest kernel updates. For Linux 6.4+ systems where patching is delayed, monitor for unusual epoll-related activity.

Covered in

digest 2026-07-06

Source on GitHub