A newly disclosed Linux kernel flaw dubbed \u201cBad Epoll\u201d (CVE-2026-46242) allows an unprivileged local user to escalate to root on Linux servers, desktops, and Android devices by exploiting a race condition and a use-after-free (UAF)<\/a> in the kernel\u2019s epoll subsystem.<\/p>\n Bad Epoll is a UAF vulnerability in ep_remove(), which clears file->f_ep under file->f_lock but continues using the file object inside the critical section during hlist_del_rcu() and spin_unlock().<\/p>\n A concurrent __fput() call can observe a transient NULL value, skip eventpoll_release_file(), and proceed straight to f_op->release, freeing a watched struct eventpoll that is still in use, corrupting kernel memory. Because struct file is SLAB_TYPESAFE_BY_RCU, the freed slot can also be recycled by alloc_empty_file(), letting an attacker trigger a kmem_cache_free() against the wrong slab cache.<\/p>\n The bug was discovered and exploited by researcher Jaeyoung Chung, who submitted it as a zero-day to Google\u2019s kernelCTF program, which pays out $71,337 or more for working Linux kernel exploits.<\/p>\n Unlike most Linux privilege-escalation bugs, Bad Epoll can root Android because epoll is a core kernel component that cannot be disabled or unloaded, unlike optional modules exploited by bugs such as Copy Fail<\/a>.<\/p>\n It is also reachable from inside Chrome\u2019s renderer sandbox, raising the possibility of chaining a renderer exploit with Bad Epoll for full kernel code execution. Despite a race window only about six instructions wide, Chung\u2019s exploit widens the window and retries without crashing the kernel, achieving roughly 99% reliability on tested targets.<\/p>\n A single 2023 kernel commit introduced two separate race conditions into the same 2,500-line epoll code path. The first, CVE-2026-43074, was discovered by Anthropic\u2019s AI model Mythos, demonstrating frontier AI\u2019s growing capability to find kernel race bugs.<\/p>\n Bad Epoll was the second, harder-to-spot flaw that Mythos<\/a> missed, likely because of its narrow timing window and the fact that it rarely triggers KASAN, the kernel\u2019s primary memory-error detector, leaving little runtime evidence behind. The maintainers\u2019 first patch attempt did not fully resolve the issue, and a correct fix landed nearly two months after initial disclosure.<\/p>\n The exploit uses four epoll objects grouped into two pairs; closing one pair triggers the race while the other becomes the victim object, turning an 8-byte UAF write into a UAF on a file object via a cross-cache attack.<\/p>\n From there, the attacker gains arbitrary kernel memory read access through \/proc\/self\/fdinfo and hijacks control flow with a return-oriented programming (ROP) chain to obtain a root shell.<\/p>\n Because epoll cannot be disabled without breaking core OS and browser functionality, there is no workaround; administrators must apply the upstream patch or await a distribution backport.<\/p>\n \u00a0Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations.\u00a0-> Integrate ANY.RUN With Your SOC <\/a>Now<\/a><\/strong>.<\/strong><\/p>\n The post New \u201cBad Epoll\u201d 0-Day Vulnerability Allows Root Access on Linux Servers and Android Devices<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n![\"Bad](\"https:\/\/i0.wp.com\/github.com\/J-jaeyoung\/bad-epoll\/raw\/main\/assets\/demo.gif?ssl=1\")
Bad Epoll Vulnerability Allows Root Access<\/strong><\/h2>\n
![\"Bad](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhFoh9AqO3x7vvWNKKEb0qX9hPDy4lI4kISsanAS0HU73xO-VkZaiGrOKmS7oPp4qzrUsy7bp5dtWcfnlaMSAv_ubvmw-3kMmOLkzrZbGBgJbQNCPw35QUhUDg6TczR0xR_enfIrGu4yoTExXdO2QHamhoz4Pboonei7lyr_A8DEcuIp8kr3H5OgLvPLvb4\/s1600\/badepoll1.webp?ssl=1\")