New Linux Flaw “Bad Epoll” (CVE-2026-46242) Empowers Users to Gain Root Access, Affecting Desktops, Servers, and Android
A recently uncovered vulnerability in the Linux kernel, identified as Bad Epoll (CVE-2026-46242), poses a significant risk by allowing unauthorized users to gain root access to systems running Linux desktops, servers, and Android devices. This flaw has been addressed with a patch, but its implications are far-reaching.
Understanding the Vulnerability
The Bad Epoll flaw resides in a critical section of kernel code, similar to a previous bug discovered by Anthropic’s AI model, Mythos. While Mythos identified one vulnerability, it overlooked this particular flaw, which was subsequently discovered by researcher Jaeyoung Chung, who successfully developed an exploit.
Epoll is a fundamental Linux feature that enables applications to monitor multiple files or network connections simultaneously. It is widely utilized by servers, network services, and web browsers, making it an integral part of the Linux ecosystem. Disabling epoll is not a feasible option, which complicates mitigation efforts.
The vulnerability is classified as a “use-after-free” bug. This occurs when two components of the kernel attempt to free the same internal object concurrently. One component releases the memory while the other continues to write to it, creating a brief window of opportunity for an attacker to corrupt kernel memory and escalate privileges from a standard user account to root.
The timing of the exploit is critical; the collision window is approximately six machine instructions wide. Random attempts to exploit this flaw are unlikely to succeed. However, Chung’s exploit effectively broadens this window, allowing successful root access in about 99% of tested scenarios.
Implications of the Flaw
The Bad Epoll vulnerability is particularly concerning for two reasons. First, it can be triggered from within Chrome’s renderer sandbox, which typically protects against many kernel vulnerabilities. Second, it extends its reach to Android, a platform often insulated from such privilege escalation bugs.
Chung reported the flaw as a zero-day to Google’s kernelCTF program, and comprehensive technical details are available in his public writeup. As of now, there is no evidence that this vulnerability has been exploited in real-world attacks, nor is it listed on CISA’s Known Exploited Vulnerabilities list. The only existing code for this exploit is a proof of concept submitted to kernelCTF, with an Android version still under development.
Both the Bad Epoll vulnerability and the earlier bug discovered by Mythos trace back to a single modification in the epoll code made in 2023. Chung noted that Mythos had previously identified the first bug, now tracked as CVE-2026-43074, which received a fix earlier in 2026.
The Challenge of Detection
Chung speculated on why the AI model failed to detect the sibling flaw. He suggested two primary reasons: the minuscule timing window makes it difficult to visualize the sequence of events, and there is often minimal runtime evidence to indicate a problem. Once the initial bug is patched, the memory error associated with Bad Epoll typically does not trigger KASAN, the kernel’s primary bug detection system, leaving no alerts to indicate an issue.
Given that epoll cannot be disabled, the only recourse is to apply the upstream commit a6dc643c6931 or to install a backport from the distribution once it becomes available. Kernels based on version 6.4 or newer are vulnerable unless they have already been patched. Older kernels, particularly those based on version 6.1, including some Android devices like the Pixel 8, are not affected since the bug was introduced in version 6.4.
A Troubling Trend for Linux Security
The emergence of Bad Epoll adds to a troubling list of kernel vulnerabilities that have been exploited to gain root access on Android devices, including previously identified issues such as Bad Binder, Bad IO_uring, and Bad Spin. This vulnerability also arrives during a period marked by a surge in Linux privilege escalation flaws, though many of these recent vulnerabilities operate under different mechanisms.
For instance, the Copy Fail vulnerability (CVE-2026-31431), identified in April, is now included in CISA’s Known Exploited Vulnerabilities list. Other vulnerabilities, such as the Dirty Frag chain, Fragnesia, DirtyClone, and pedit COW, have also surfaced in recent months.
Unlike these deterministic page-cache-write bugs, which do not involve a race condition, Bad Epoll represents an older, more complex type of vulnerability that requires winning a race condition, akin to the notorious Dirty Cow exploit from 2016.
Additionally, a public proof-of-concept has surfaced for CVE-2026-31694, another vulnerability in the kernel’s FUSE filesystem code, discovered by the AI-driven research firm Bynario. This flaw allows a local user with FUSE access to introduce a malicious filesystem to the kernel, potentially leading to root access, data leaks, or system crashes.
Conclusion
The Bad Epoll vulnerability exemplifies the challenges associated with detecting and mitigating race conditions in kernel code. It underscores the importance of continuous vigilance in cybersecurity, as even advanced AI models can miss critical vulnerabilities. As the landscape of Linux security evolves, the need for robust detection and remediation strategies becomes increasingly vital.
Source: thehackernews.com
Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.
