Loading story…
A use-after-free race in the Linux kernel's epoll subsystem, tracked as CVE-2026-46242 and dubbed Bad Epoll, allows an unprivileged local user to escalate to root and may also be reachable from constrained environments including the Chrome renderer sandbox and potentially Android. The bug was introduced in 2023 in fs/eventpoll.c, stems from a race in ep_remove() and ep_remove_file() during concurrent close operations on related epoll file objects, and was reported by Jaeyoung Chung of Seoul National University as a 0-day submission to Google's kernelCTF. Public reporting says the exploit achieves roughly 99% reliability on some targets despite a narrow race window, making it unusually dangerous for a modern Linux local privilege-escalation flaw.
Researchers and vendors said there is no practical workaround because epoll is a core kernel feature, and fixes were issued through upstream and backported updates including 6.6.144+ and 6.12.95+, with advisories for distributions such as Debian trixie, RHEL 9, RHEL 10, and Azure Linux 3. The disclosures also tied the issue to a broader pattern of advanced exploit discovery in kernel and browser-adjacent code: Google Project Zero previously highlighted renderer-to-kernel exploitation paths using MSG_OOB, while Anthropic said its Mythos Preview system found a separate epoll race, CVE-2026-43074, in the same area of code. Maintainers noted that fixing that earlier epoll bug did not eliminate Bad Epoll, underscoring how difficult this code path has been to secure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-11, Codeby published a technical breakdown of CVE-2026-46242 covering the race condition, exploit reliability, affected kernel branches, and patched versions. The article also noted enterprise distribution advisories and backported fixes.
Jaeyoung Chung of Seoul National University Computer Security Lab reported CVE-2026-46242 and submitted it as a 0-day to Google's kernelCTF, along with a highly reliable local privilege escalation exploit. The reporting described the bug as potentially reachable from Chrome's renderer sandbox and relevant to Android rooting scenarios.
The Bad Epoll vulnerability was fixed in April 2026 by commit a6dc643c6931. Later patched kernel lines included 6.6.144+ and 6.12.95+, with downstream vendors issuing advisories or backports.
The use-after-free race behind CVE-2026-46242 was introduced by commit 58c9b016e128 in 2023, creating a local privilege escalation flaw in the epoll subsystem.
On 2026-04-07, Anthropic announced Claude Mythos Preview and Project Glasswing, saying the model could autonomously find and exploit zero-day vulnerabilities across major software targets. The company said it was withholding most technical details because more than 99% of the findings remained unpatched.
On 2026-07-08, an oss-security post publicly described CVE-2026-46242 ('Bad Epoll') as a Linux local privilege escalation vulnerability affecting Linux and potentially Android. The disclosure highlighted the lack of a practical workaround and contrasted the bug with the related epoll race CVE-2026-43074.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
codeby.net
Open sourcered.anthropic.com
Open sourceprojectzero.google
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Jul 11, 2026
Researchers disclosed **Fragnesia** (`CVE-2026-46300`), a Linux kernel local privilege escalation flaw that allows an unprivileged local user to gain **root** by corrupting the kernel page cache for read-only files. The bug, discovered by William Bowling of Zellic and the V12 team, is described as a new variant in the Dirty Frag family and affects Linux kernels released before May 13, 2026. It stems from faulty bookkeeping when shared page fragments are merged in socket buffers and can be triggered through the kernel's XFRM **ESP-in-TCP** path, with additional exposure through `rxrpc` on some systems. A public proof-of-concept exploit modifies the in-memory copy of files such as `/usr/bin/su` to spawn a root shell while leaving the on-disk binary unchanged, reducing forensic visibility. Vendors and distributions moved quickly to publish advisories, patches, and mitigations as exploit code became public. AlmaLinux said releases 8, 9, and 10 are affected through `esp4` and `esp6`, with AlmaLinux 9 and 10 also exposed through `rxrpc` when `kernel-modules-partner` is installed, and released backported fixes ahead of upstream vendor updates. Recommended mitigations include disabling or blacklisting the `esp4`, `esp6`, and `rxrpc` kernel modules, restricting unprivileged user namespaces, and monitoring for suspicious namespace creation or XFRM manipulation; AlmaLinux also advised dropping page cache if compromise is suspected. The disclosure comes amid heightened concern over Linux local-root bugs in the same code area, and one cybercrime forum post reportedly advertised a Linux LPE zero-day for sale for **$170,000**.
Jun 29, 2026
Researchers publicly disclosed **Dirty Frag**, a Linux kernel local privilege escalation chain that can give an unprivileged local user immediate root access across major distributions. The disclosure said the issue combines flaws in the in-place decryption fast paths for **`esp4`**, **`esp6`**, and **`rxrpc`**, allowing page-cache corruption or plaintext exposure in externally backed paged fragments. Public write-ups and exploit repositories described two working paths: overwriting **`/usr/bin/su`** with a root shell via the ESP/XFRM stack, or corrupting **`/etc/passwd`** through RXRPC/RXKAD behavior so a UID 0 account can be used without a password. The bug was published without patches or CVE assignments after an embargo was reportedly broken, and exploit code was quickly made public through oss-sec, GitHub, and security forums. A related GitHub proof of concept, **Copy Fail 2: Electric Boogaloo**, tied the ESP path to the **`MSG_SPLICE_PAGES`** no-copy-on-write fast path and reported successful exploitation on Debian, Arch, Fedora, and newer Ubuntu releases, while noting older Ubuntu 22.04 kernels were not affected by that specific path. AlmaLinux said all supported releases were affected, issued patched kernels in testing by backporting the upstream ESP fix, and recommended temporary mitigations including blacklisting or unloading **`esp4`**, **`esp6`**, and **`rxrpc`** modules and dropping page cache if compromise is suspected.
Jun 29, 2026