Loading story…
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers root access across a wide range of systems, including servers, desktops, and Android devices. One bug, CVE-2026-46242 or Bad Epoll, is a use-after-free race in the kernel's epoll subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because epoll is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports.
A second flaw, CVE-2026-43456, affects the kernel's net/bonding subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible header_ops handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions 2.6.24 through 6.12.77 and requires CAP_NET_ADMIN privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Get the actors, campaigns, and ATT&CK mapping behind it.
21 events from the most recent confirmed update back to the earliest known activity.
Red Hat published advisory RHSA-2026:43825 on 2026-07-22, releasing an Important kpatch live kernel update for RHEL 9.8 based on kernel-5.14.0-687.10.1.el9_8. The advisory remediates CVE-2026-46242 (Bad Epoll) and CVE-2026-53359 across multiple RHEL 9.8 x86_64 and ppc64le offerings, including EUS, ELC, and SAP Solutions variants.
Red Hat published advisory RHSA-2026:44007 on 2026-07-22, releasing Important kpatch live kernel updates for multiple RHEL 9.6 Extended Update Support and related variants. The advisory remediates CVE-2026-46242 (Bad Epoll) and CVE-2026-53359 for kernel-5.14.0-570.17.1.el9_6 across x86_64 and ppc64le offerings.
Red Hat published advisory RHSA-2026:44006 on 2026-07-22, releasing Important kpatch live kernel updates for multiple RHEL 9.4 Update Services for SAP Solutions, AUS, and Extended Life Cycle offerings. The advisory remediates CVE-2026-46242 (Bad Epoll) and CVE-2026-53359 for kernel 5.14.0-427 series packages across x86_64 and ppc64le systems.
Red Hat published advisory RHSA-2026:43826 for RHEL 10 on 2026-07-22, releasing a kpatch live kernel update for kernel-6.12.0-211.16.1.el10_2. The update remediates CVE-2026-46242 (Bad Epoll) along with CVE-2026-53362 and CVE-2026-53359 across multiple RHEL 10 x86_64 and ppc64le offerings.
Red Hat published advisory RHSA-2026:40779 on 2026-07-21, releasing OpenShift Container Platform 4.21.25 as an Important security update. The release updates packages and container images to fix CVE-2026-46242 along with CVE-2026-46316 and CVE-2026-53359, and Red Hat advised OpenShift 4.21 users to upgrade through the appropriate release channel.
Red Hat published advisory RHSA-2026:40787 for OpenShift Container Platform 4.20.30, updating packages and container images to fix CVE-2026-46242 along with CVE-2026-46316 and CVE-2026-53359. Red Hat advised OpenShift 4.20 users across multiple architectures to upgrade through the appropriate release channel using the OpenShift CLI or web console.
Red Hat issued advisory RHSA-2026:37729 for RHEL 9.4 Update Services for SAP Solutions and related variants, releasing kernel package 5.14.0-427.137.1.el9_4. The update fixes CVE-2026-43074, CVE-2026-46242, and CVE-2026-53359, and Red Hat instructed customers to reboot after applying it.
Red Hat documented CVE-2026-53266 as a Linux kernel netfilter flaw in the ebtables SNAT target, where ARP hardware-address rewriting could write through skb_store_bits() into shared or file-backed nonlinear socket-buffer pages without verifying writability. The advisory said the bug could cause memory corruption, crashes, denial of service, and possible privilege escalation in containerized or virtualized bridge-networking environments, and noted it was fixed in RHEL 9 via RHSA-2026:36645 and in RHEL 8 via RHSA-2026:39082 and RHSA-2026:39083.
Red Hat published RHSA-2026:36645 on 2026-07-08, releasing an Important kernel security update for Red Hat Enterprise Linux 9. The advisory fixes CVE-2026-46242 (Bad Epoll), CVE-2026-43074, and CVE-2026-53266 across multiple RHEL 9 variants and architectures, and instructs customers to reboot after applying it.
Red Hat published RHSA-2026:36541 on 2026-07-08, releasing an Important kernel security update for Red Hat Enterprise Linux 10. The advisory fixes CVE-2026-46242 (Bad Epoll) along with CVE-2026-43074, CVE-2026-43276, CVE-2026-43341, CVE-2026-46155, and CVE-2026-46259, and instructs customers to reboot after applying it.
Red Hat published RHSA-2026:36186 on 2026-07-07, releasing an Important kernel security update for NVIDIA for RHEL 10 on ARM64/aarch64. The advisory fixes CVE-2026-46242 (Bad Epoll) and CVE-2026-43074 in kernel package version 6.12.0-231.15.el10nv and instructs customers to reboot after applying it.
Red Hat documented CVE-2026-43074 as a Linux kernel eventpoll use-after-free flaw where ep_free() could free a struct eventpoll object while another thread was still using it. The advisory said the upstream fix defers freeing the structure until an RCU grace period elapses, and noted the issue was later addressed across multiple RHEL product advisories.
Red Hat's Bugzilla advisory for CVE-2026-46242 described the eventpoll use-after-free in detail, explaining how ep_remove() could race with __fput() and lead to memory corruption and an attacker-controllable wrong-cache free. The advisory also documented the fix of pinning the file with epi_fget() at the start of ep_remove() to prevent the object from reaching refcount zero during the critical section.
A proof-of-concept exploit was released for CVE-2026-46242 ('Bad Epoll'), providing public exploitation details for the Linux kernel local privilege-escalation flaw. The release increased the risk of real-world exploitation and reinforced guidance for organizations to patch affected systems.
The Linux kernel flaw CVE-2026-43456 was patched in March 2026. The issue affected versions 2.6.24 through 6.12.77 and could be mitigated by updating the kernel or temporarily disabling unprivileged user namespaces or the bonding module.
A type-confusion flaw later tracked as CVE-2026-43456 was introduced in 2007 in the Linux kernel's net/bonding subsystem, creating a long-lived local privilege-escalation condition.
A newly disclosed Linux kernel vulnerability dubbed Bad Epoll, tracked as CVE-2026-46242, was reported as enabling unprivileged local users to gain root on Linux servers, desktops, and Android devices via the epoll subsystem.
After an initial patch attempt failed, the correct upstream fix for CVE-2026-46242 was merged nearly two months after disclosure. Defenders were advised to apply the upstream fix or wait for vendor backports because no practical workaround exists.
Researcher Jaeyoung Chung discovered and exploited CVE-2026-46242 through Google's kernelCTF program, demonstrating root privilege escalation from an unprivileged local context on Linux and Android.
A 2023 Linux kernel commit introduced the use-after-free race condition later dubbed Bad Epoll and tracked as CVE-2026-46242. The same commit also created another race condition, CVE-2026-43074.
Red Hat documented CVE-2026-46316 as a Linux kernel flaw in KVM arm64 vgic-its where concurrent translation-cache invalidation could drop references multiple times and free an entry still mapped by an ITE. The fix changed the logic to release only the entry actually removed by xa_erase(), ensuring each cache entry is dereferenced exactly once.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
29 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcegithub.com
Open sourcepeople.canonical.com
Open sourcegit.kernel.org
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A **use-after-free race** in the Linux kernel's `epoll` subsystem, tracked as **`CVE-2026-46242`** and dubbed **Bad Epoll**, allows an unprivileged local user to escalate to **root** and may also be reachable from constrained environments including the **Chrome renderer sandbox** and potentially **Android**. The bug was introduced in 2023 in `fs/eventpoll.c`, stems from a race in `ep_remove()` and `ep_remove_file()` during concurrent close operations on related epoll file objects, and was reported by **Jaeyoung Chung** of Seoul National University as a **0-day** submission to Google's **kernelCTF**. Public reporting says the exploit achieves roughly **99% reliability** on some targets despite a narrow race window, making it unusually dangerous for a modern Linux local privilege-escalation flaw. Researchers and vendors said there is **no practical workaround** because `epoll` is a core kernel feature, and fixes were issued through upstream and backported updates including **6.6.144+** and **6.12.95+**, with advisories for distributions such as **Debian trixie, RHEL 9, RHEL 10, and Azure Linux 3**. The disclosures also tied the issue to a broader pattern of advanced exploit discovery in kernel and browser-adjacent code: Google Project Zero previously highlighted renderer-to-kernel exploitation paths using `MSG_OOB`, while Anthropic said its **Mythos Preview** system found a separate epoll race, **`CVE-2026-43074`**, in the same area of code. Maintainers noted that fixing that earlier epoll bug did not eliminate Bad Epoll, underscoring how difficult this code path has been to secure.
Jul 14, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026
Researchers disclosed multiple Linux kernel memory-corruption vulnerabilities affecting network-facing components, including a **remote heap overflow** in the Transparent Inter Process Communication (**TIPC**) module tracked as `CVE-2021-43267`, and a later packet-socket flaw, `CVE-2025-38617`, that was shown to be exploitable through a race condition. The TIPC issue exposed systems running the module to potential **arbitrary code execution in kernel context**, highlighting the risk posed by rarely used but reachable networking features in default or enterprise Linux deployments. Additional advisory coverage from the Zero Day Initiative underscored continued security concerns around Linux kernel bug classes such as heap overflows and race conditions, which can be leveraged for **privilege escalation** or full system compromise depending on exposure and configuration. Together, the reports show that flaws in low-level packet handling and inter-process communication paths remain a high-impact attack surface, especially where vulnerable kernel modules are enabled or accessible to untrusted users or networks.
Jun 29, 2026