Linux Kernel epoll Race Condition UAF Privilege Escalation (CVE-2026-46242)

Vulnerability Overview Bad Epoll (CVE-2026-46242) is a race condition use-after-free (UAF) vulnerability in the subsystem of the Linux kernel. This vulnerability allows unprivileged processes to escalate privileges to root. It affects not only Linux desktops and servers but also Android devices. Scope of Impact Android Devices: While most Linux privilege escalation vulnerabilities cannot achieve root on Android, Bad Epoll is an exception. Chrome Renderer Sandbox: Bad Epoll can also be triggered from within the Chrome renderer sandbox, which almost entirely eliminates other kernel vulnerabilities as viable attack vectors. Kernel Modules: Issues like "Copy Fail" and its variants can be mitigated by unloading vulnerable modules, but there is no such option for . Kernel Versions: Bad Epoll was introduced in kernel versions v6.4 and newer, and affects kernels prior to v6.1. Remediation Patch: The only mitigation is to apply the patch. The upstream commit or the distribution's backport patch should be applied immediately when available. Timeline: - 2023-04-08: Vulnerability introduced to . - 2026-02-17: Vulnerability reported to . - 2026-02-17: Maintainers proposed a patch prototype, which was not the correct fix; discussions subsequently stalled. - 2026-04-02: Fix for another vulnerability discovered by Mythos (CVE-2026-43074) entered the mainline. - 2026-04-22: Remaining issues re-reported. - 2026-04-24: Fix for this vulnerability entered the mainline. POC Code Other Key Information Vulnerability Severity: - Rare Vulnerability: Bad Epoll is a rare vulnerability capable of rooting Android devices. - No Kill-switch: is a core kernel function and cannot be neutralized by unloading modules. - Tiny Race Window: The race window is only about six instructions wide, yet the attack reliability is as high as 99%. Discovery History: - Vulnerability discovered by Mythos: Anthropic's AI, Mythos, discovered another race condition vulnerability (CVE-2026-43074) but missed Bad Epoll. - Independent Researcher: An independent researcher subsequently submitted a 1-day exploit that successfully leveraged this vulnerability. Attack Mechanics: - Epoll Objects: The attack utilizes four objects, divided into two groups. One group triggers the race condition, while the other serves as the victim. - UAF Exploitation: It exploits an 8-byte UAF to write to a file object and achieves full control over the file content via a cross-cache attack. - Kernel Memory Read: Arbitrary kernel memory reads are obtained via , eventually hijacking the control flow and executing an ROP chain. Affected Versions Kernel Versions: v6.4 and newer kernels. Android Devices: Pixel 10 (kernel v6.6+) and Pixel 8, among other devices with kernels prior to v6.1. Timeline 2023-04-08: Vulnerability introduced to . 2026-02-17: Vulnerability reported to . 2026-02-17: Maintainers proposed a patch prototype, which was not the correct fix; discussions subsequently stalled. 2026-04-02: Fix for another vulnerability discovered by Mythos (CVE-2026-43074) entered the mainline. 2026-04-22: Remaining issues re-reported. 2026-04-24: Fix for this vulnerability entered the mainline. FAQ Why is it called "Bad Epoll"? - The name follows the "Bad" series of Android kernel vulnerabilities, such as Bad Binder, Bad IO_uring, and Bad Spin. Bad Epoll is the counterpart for . Where can I find technical details? - This page provides a short version. For complete technical details, exploit write-ups, and code, please refer to the following links: - Root-cause writeup - Exploit writeup - Exploit code Acknowledgements Reporter and Exploiter: Jaeyoung Chung Research Team: CompSec Lab Special Thanks: Eulgyu Kim, Woohyuk Choi, Dae R. Jeong, and advisor Byounghyoung Lee --- The above is a summary of the key information regarding the Bad Epoll vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Linux Kernel epoll Race Condition UAF Privilege Escalation (CVE-2026-46242)

More from this source