Summary
Technical details and a working proof-of-concept exploit for CVE-2026-46242, a Linux kernel privilege escalation vulnerability dubbed “Bad Epoll,” have been publicly released. The vulnerability allows unprivileged local users to gain full root access on Linux desktops, servers, and Android devices running kernel version 6.4 or newer.
Bad Epoll is a race-condition use-after-free bug in the epoll subsystem — Linux’s I/O event notification facility. The flaw occurs when two eventpoll file descriptor lists monitor each other and are closed simultaneously: one frees an object while the other continues writing to it. The vulnerability was discovered by Jaeyoung Chung of Seoul National University’s Computer Security Lab, who reported it through Google’s kernelCTF program.
The PoC exploit triggers the race condition to leak kernel memory, then hijacks an indirect call to control the CPU’s instruction pointer via a Return-Oriented Programming (ROP) chain, ultimately achieving root. Notably, the flaw proved difficult to fix — the Linux maintainers’ first patch was incomplete, and a correct fix only landed two months after the initial report. The vulnerability was also confirmed on Pixel 10 devices running kernel 6.6. Interestingly, Bad Epoll was introduced in a 2023 commit that also introduced CVE-2026-43074, another epoll race condition that was found by Anthropic’s Mythos model — but Mythos missed Bad Epoll because it does not trigger KASAN after the sibling fix.
Source
SecurityWeek — Proof-of-Concept Exploit Released for Linux Bad Epoll Root Access Vulnerability
GitHub — Bad Epoll PoC
Commentary
This is a significant local privilege escalation that affects a massive surface area — essentially every modern Linux deployment and recent Android devices. The fact that the maintainers’ first patch was incorrect and the real fix took two months highlights how subtle kernel race conditions can be, even for experienced developers.
The Mythos angle is fascinating: an AI model found the sibling bug in the same commit but missed this one because the fix for the first bug masked the second from KASAN detection. It’s a neat illustration of both AI’s growing utility in vulnerability research and its current blind spots. For defenders, the message is straightforward — patch your kernels. With a public PoC now available, exploitation in the wild is a matter of when, not if.