Bad Epoll Linux Flaw Reaches Android Without A Public Patch Timetable
A newly disclosed Linux kernel flaw tracked as CVE-2026-46242 can let an unprivileged local user gain root access on Linux systems and may be reachable from Android or Chrome sandbox contexts, but public material did not give a distribution-by-distribution patch timetable.
Bad Epoll Lets Ordinary Linux Users Reach Root
A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access take full control of an affected machine as root.
The vulnerability affects Linux desktops, servers and Android, and a fix is available, The Hacker News reported.
The flaw sits in epoll, a standard Linux feature that allows programs to watch many files or network connections at once.
Servers, network services and web browsers rely on it, so administrators cannot simply switch the feature off.
How the Race Works
Bad Epoll is a use-after-free bug involving two parts of the kernel cleaning up the same internal object at the same time.
One path frees the memory while the other is still writing to it.
That collision can corrupt kernel memory and move an attacker from a normal account to root access.
The attack depends on timing.
The collision window is only about six machine instructions wide, making a random attempt extremely unlikely to succeed.
Security researcher Jaeyoung Chung built an exploit that widens the window and retries without crashing.
It reached root about 99% of the time on tested systems.
Chung submitted the flaw as a zero-day to Google’s kernelCTF program, and full technical details are available in his public writeup.
The vulnerability traces back to a single 2023 change to the epoll code.
The same stretch of code contained another flaw, now tracked as CVE-2026-43074, which Anthropic’s Mythos model found and which received a fix earlier in 2026.
Anthropic has separately said Mythos found Linux kernel privilege-escalation bugs, but it has not publicly linked that work to Bad Epoll.
Chung found Bad Epoll and built the working attack.
Why Chrome and Android Matter
Chung said the flaw can be triggered from inside Chrome’s renderer sandbox, a boundary that blocks almost every other kernel bug.
He also reported that it can reach Android, where many Linux privilege-escalation vulnerabilities do not apply.
The difficulty is not limited to finding the race.
After the first bug was patched, Bad Epoll’s memory error usually did not trigger KASAN, the kernel’s main bug detector, leaving little evidence at runtime.
Chung identified the tiny timing window and weak runtime signal as likely reasons Mythos missed the sibling flaw, while noting that no one can be certain.
There is no sign that Bad Epoll has been used in real attacks.
As of the disclosure, it was not listed in CISA’s Known Exploited Vulnerabilities catalog, and the only working code was the kernelCTF proof of concept.
An Android version of the exploit was still in progress.
Patch Status
Epoll cannot be disabled, so there is no workaround.
Administrators should apply upstream commit a6dc643c6931 or install their distribution’s backport when it becomes available.
Kernels built on 6.4 or newer are affected unless they already contain the fix.
Older 6.1-based kernels, including some Android phones such as the Pixel 8, are not affected because the bug was introduced in 6.4.
