Bad Epoll CVE-2026-46242: Linux Kernel Privilege Escalation Hits Android

A newly disclosed Linux kernel vulnerability dubbed “Bad Epoll” (CVE-2026-46242) allows an unprivileged user to escalate to root on Linux desktops, servers, and Android devices. The flaw is a use-after-free in the kernel’s epoll subsystem, and a working exploit with 99% reliability has already been published.

Disclosed on July 3, 2026, Bad Epoll is notable for being exploitable from inside Chrome’s renderer sandbox. Consequently, a renderer compromise could chain with this bug to achieve full kernel code execution. The vulnerability was reported by researcher Jaeyoung Chung as a zero-day submission to Google’s kernelCTF, earning a $71,337+ reward.

What Happened: Bad Epoll Linux Kernel Privilege Escalation Disclosed

Bad Epoll (CVE-2026-46242) is a race-condition use-after-free in the Linux kernel’s eventpoll subsystem. The bug was introduced by a single commit in 2023 that created two separate race conditions in approximately 2,500 lines of epoll code. Anthropic’s Mythos AI model discovered the first race (CVE-2026-43074), but missed Bad Epoll entirely.

Researcher Jaeyoung Chung independently found and exploited Bad Epoll, submitting it to Google’s kernelCTF program. The exploit demonstrates reliable root access on Linux and Android systems. Furthermore, because the bug resides in epoll — a core kernel feature that servers, browsers, and network services all depend on — there is no simple workaround like unloading a vulnerable module.

Technical Details of the Bad Epoll Vulnerability

The vulnerability stems from a race condition in epoll’s close paths. Two epoll objects close simultaneously, and one frees memory while the other is still writing into it. This use-after-free allows an attacker to corrupt kernel memory and escalate privileges.

Bad Epoll is particularly significant because it can also be triggered from inside Chrome’s renderer sandbox. Most Linux privilege escalation bugs cannot escape Android’s security model or Chrome’s sandbox. However, Bad Epoll is one of only about ten vulnerabilities from Google’s kernelCTF that can root Android devices.

Exploit Reliability and Attack Mechanics

The race window is only about six instructions wide, making the bug extremely difficult to hit under normal conditions. However, the published exploit overcomes this through a clever retry loop:

• Four epoll objects are grouped into two pairs
• One pair triggers the race while the other becomes the victim
• The 8-byte UAF write is transformed into a file object use-after-free
• A cross-cache attack fully controls the file’s contents
• Arbitrary kernel memory read is achieved through /proc/self/fdinfo

After the race succeeds, the exploit never crashes the kernel. The result is a 99% reliable exploit that works against unpatched systems.

No Kill-Switch Available

Unlike previous kernel bugs such as Copy Fail and its variants, Bad Epoll cannot be neutralized by unloading a vulnerable module. Epoll is a core kernel feature that the operating system, network services, and web browsers all rely on. The only remediation is to apply the kernel patch.

Business and Operational Impact

Bad Epoll affects a wide range of systems. Therefore, organizations running Linux or Android should assess their exposure carefully.

• Linux servers: Any unpatched Linux server with untrusted local users is at risk of privilege escalation
• Android devices: The vulnerability can root Android, making it a serious concern for mobile security
• Chrome sandbox bypass: A renderer exploit combined with Bad Epoll achieves kernel code execution
• Container escape risk: Containers running on unpatched hosts may be vulnerable if an attacker gains initial access
• Cloud workloads: Shared hosting and multi-tenant environments face elevated risk from local privilege escalation

Mitigation and Recommendations

Organizations should prioritize patching affected Linux kernel versions. Moreover, defenders should monitor for signs of exploitation even on patched systems, as attackers may have already established persistence.

Immediate Actions for Defenders

1. Apply kernel patches immediately. Linux kernel maintainers have released patches for CVE-2026-46242. Update all affected systems as soon as possible.
2. Monitor for epoll exploitation patterns. Look for unusual privilege escalation activity, unexpected root shells, and anomalous /proc/self/fdinfo access in security logs.
3. Restrict local access on shared systems. In multi-tenant or shared hosting environments, limit local user access until patches are applied.
4. Update Android devices promptly. Device manufacturers and carriers should push security updates containing the Bad Epoll patch.
5. Audit Chrome sandbox escapes. Review browser security configurations and ensure Chrome is updated to the latest version.

Additional Guidance

Security teams should also review their vulnerability management processes. The fact that a frontier AI model examined the same code and missed this bug suggests that race-condition vulnerabilities remain a challenging class of flaw to detect automatically. Furthermore, the exploit’s high reliability means that unpatched systems face near-certain compromise if an attacker targets them.

Bottom line: CVE-2026-46242 is a serious Linux kernel privilege escalation with a reliable public exploit and no workaround. Patch all affected Linux and Android systems immediately.

Incident Summary

CVE ID / Incident:	CVE-2026-46242 (Bad Epoll)
Affected Systems:	Linux kernel (desktops, servers, Android devices); Chrome renderer sandbox on unpatched systems
Disclosure Date:	July 3, 2026
Patch Status:	Available — patches released by Linux kernel maintainers

References

1. Jaeyoung Chung, “bad-epoll,” GitHub, July 3, 2026, https://github.com/J-jaeyoung/bad-epoll, accessed July 3, 2026.
2. The Hacker News, “New ‘Bad Epoll’ Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android,” July 3, 2026, https://thehackernews.com/2026/07/bad-epoll-linux-kernel-flaw-lets.html, accessed July 3, 2026.
3. SentinelOne, “CVE-2026-46242: Linux Kernel Use-After-Free Vulnerability,” https://www.sentinelone.com/vulnerability-database/cve-2026-46242/, accessed July 3, 2026.
4. Red Hat, “CVE-2026-46242,” Red Hat Customer Portal, https://access.redhat.com/security/cve/cve-2026-46242, accessed July 3, 2026.
5. Debian Security Tracker, “CVE-2026-46242,” https://security-tracker.debian.org/tracker/CVE-2026-46242, accessed July 3, 2026.