Bad Epoll Linux Kernel Flaw Enables Root Access From Unprivileged and Sandbox Contexts

A use-after-free race in the Linux kernel's epoll subsystem, tracked as CVE-2026-46242 and dubbed Bad Epoll, allows an unprivileged local user to escalate to root and may also be reachable from constrained environments including the Chrome renderer sandbox and potentially Android. The bug was introduced in 2023 in fs/eventpoll.c, stems from a race in ep_remove() and ep_remove_file() during concurrent close operations on related epoll file objects, and was reported by Jaeyoung Chung of Seoul National University as a 0-day submission to Google's kernelCTF. Public reporting says the exploit achieves roughly 99% reliability on some targets despite a narrow race window, making it unusually dangerous for a modern Linux local privilege-escalation flaw.

Researchers and vendors said there is no practical workaround because epoll is a core kernel feature, and fixes were issued through upstream and backported updates including 6.6.144+ and 6.12.95+, with advisories for distributions such as Debian trixie, RHEL 9, RHEL 10, and Azure Linux 3. The disclosures also tied the issue to a broader pattern of advanced exploit discovery in kernel and browser-adjacent code: Google Project Zero previously highlighted renderer-to-kernel exploitation paths using MSG_OOB, while Anthropic said its Mythos Preview system found a separate epoll race, CVE-2026-43074, in the same area of code. Maintainers noted that fixing that earlier epoll bug did not eliminate Bad Epoll, underscoring how difficult this code path has been to secure.