Exploitation observed; activity peaked at 22 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-30 | 4 | Disclosure2General1Patch1 |
| 2026-05-31 | 1 | Active Exploitation1 |
| 2026-06-24 | 1 | PoC1 |
| 2026-07-03 | 11 | Active Exploitation1Disclosure5Exploit1General1Patch1PoC2 |
| 2026-07-04 | 18 | Active Exploitation1Disclosure12Exploit1General1Patch1PoC2 |
| 2026-07-05 | 7 | Active Exploitation1Disclosure1Exploit1General1Patch3 |
| 2026-07-06 | 22 | Active Exploitation1Disclosure9Exploit3Patch6PoC3 |
| 2026-07-07 | 9 | Disclosure2Exploit1General2Patch4 |
| 2026-07-08 | 6 | Disclosure1General1Patch3PoC1 |
| 2026-07-09 | 3 | Disclosure2Patch1 |
| 2026-07-11 | 1 | General1 |
| 2026-07-12 | 2 | Disclosure1PoC1 |
| 2026-07-13 | 2 | Disclosure2 |
| 2026-07-14 | 4 | Exploit2PoC2 |
| 2026-07-15 | 4 | Disclosure1General1PoC2 |
| 2026-07-17 | 2 | Exploit1PoC1 |
| 2026-07-19 | 1 | Patch1 |
| 2026-07-22 | 10 | Active Exploitation1Disclosure4General1PoC4 |
| 2026-07-28 | 1 | General1 |
| 2026-08-01 | 1 | Patch1 |
| 2026-08-04 | 1 | PoC1 |
| 2026-08-15 | 1 | General1 |
| 2026-08-18 | 1 | General1 |
| 2026-08-21 | 1 | PoC1 |
Added 4 new LPE exploits to lpe-toolkit: - PEdit COW CVE-2026-46331 - DirtyClone CVE-2026-43503 - Bad Epoll CVE-2026-46242 - FUSE OOB CVE-2026-31694 https://github.com/portbuster1337/lpe-toolkit
Post summary
The post announces four new local privilege escalation exploits added to the lpe-toolkit repository, providing GitHub access to the exploit code and specifying the relevant CVE identifiers.
New "Bad Epoll" 0-Day Vulnerability Allows Root Access on Linux Servers & Android Devices Source: https://cybersecuritynews.com/bad-epoll-0-day-vulnerability/ A newly disclosed Linux kernel flaw dubbed "Bad Epoll" (CVE-2026-46242) allows an unprivileged local user to escalate to root on Linux servers, desktops, and Android devices by exploiting a race condition and a use-after-free (UAF) in the kernel's epoll subsystem. Bad Epoll is a UAF vulnerability in ep_remove(), which clears file->f_ep under file->f_lock but continues using the file object inside the critical section during hlist_del_rcu() and spin_unlock(). #cybersecuritynews
Post summary
Newly disclosed CVE‑2026‑46242, dubbed "Bad Epoll", is a race‑condition and use‑after‑free flaw in the Linux kernel’s epoll subsystem that allows local users to gain root on Linux servers, desktops and Android devices. No PoC, patch, or active exploitation information is provided, only technical details of the vulnerability.
Bad Epoll: missed by Mythos. Mythos found one critical race in Linux epoll. The other was hiding in a ~6-instruction race window. I found and exploited it as CVE-2026-46242: 99% reliable root on Google kernelCTF, with potential Android impact. http://badepoll.com https://t.co/k2JJp02Ni2
Post summary
The author announces discovering a race condition in Linux epoll (CVE-2026-46242), provides a proof‑of‑concept exploit that achieves root on the Google kernelCTF platform, and suggests possible Android impact.
Race-condition use-after-free in the Linux kernel's epoll subsystem (Bad Epoll, CVE-2026-46242) https://github.com/J-jaeyoung/bad-epoll #infosec https://t.co/9yx0aUONx6
Post summary
The tweet announces a race‑condition use‑after‑free vulnerability in Linux’s epoll (CVE‑2026‑46242) and links to a GitHub repo containing a POC. It does not mention patches, active exploitation, or false‑positive claims.
⚡ New "Bad Epoll" (CVE-2026-46242) vulnerability affects #Linux 6.4+ kernels and may reach newer #Android devices. It can turn a local user into root; the PoC hit 99% reliability and may trigger from Chrome’s renderer sandbox. 🔗 Read how the bug works: https://thehackernews.com/2026/07/new-bad-epoll-linux-kernel-flaw-lets.html https://t.co/0l1EIc7qpO
Post summary
The post announces CVE‑2026‑46242, a Linux kernel flaw named "Bad Epoll," noting a 99% reliable PoC that can elevate local users to root—potentially via Chrome’s renderer sandbox—and provides a link for full details.
Bad Epoll: The bug missed by Mythos Article by Jaeyoung Chung about exploiting CVE-2026-46242 — a race condition bug in the eventpoll subsystem. Jaeyoung exploited this bug to claim a kernelCTF entry, but the vulnerability also affects Android kernels. https://github.com/J-jaeyoung/bad-epoll https://t.co/y8nSlw4BQe
Post summary
The text announces that a race‑condition flaw (CVE‑2026‑46242) in the Linux eventpoll subsystem has been exploited, with PoC code available on GitHub, enabling kernel exploitation as demonstrated by Jaeyoung Chung.
A PoC/exploit has been discovered for vulnerability CVE-2026-46242 PT ID: PT-2026-45095 Vendor: Linux Product: Linux kernel Description: A race condition in the epoll subsystem allows an unprivileged local user to escalate privileges to root. The issue occurs in the ep remove() function (via ep remove file()), which clears file->f ep under file->f lock but continues to use the @file object within the critical section during hlist del rcu() and spin unlock(). A concurrent fput() can trigger the eventpoll release() fastpath, leading to a Use-After-Free (UAF) condition where the watched struct eventpoll is freed via ep free(), causing subsequent memory corruption. Additionally, because struct file is SLAB TYPESAFE BY RCU, the memory slot could be recycled by alloc empty file(), potentially allowing an attacker to control kmem cache free() against the wrong slab cache. Link: https://github.com/J-jaeyoung/bad-epoll #dbugs_vuln
Post summary
A proof‑of‑concept exploit for CVE‑2026‑46242 has been published, detailing a race condition in the Linux kernel’s epoll subsystem that results in a use‑after‑free and privilege escalation; however, no real‑world exploitation or patch information is mentioned.
لازال الباحثين في الامن السيبراني يثبتون ان العامل البشري مهم ولايمكن الاستغناء عنه حالياً الباحث Jaeyoung Chung قدر يكتشف ثغره من نوع "Race Condition" لم يكتشفها "Mythos" هالنوع صعب اكتشافه ومعقد ورغم ذلك قدر يكتشف ثغره في نواه لينكس اسمها Bad Epoll رقمها CVE-2026-46242 يتبع/ https://t.co/65ILmWuAwQ
Post summary
The text announces the discovery of a race-condition vulnerability in the Linux kernel's Bad Epoll component (CVE-2026-46242) by researcher Jaeyoung Chung.
Linux Kernelの権限昇格脆弱性「CVE-2026-46242（Bad Epoll）」。 epoll処理のUse-After-FreeによりRoot権限を取得できるといったもの。 こちらの脆弱性悪用にはローカルへのアクセス権が必要なものの侵入後の権限昇格に悪用される恐れがありますね。 https://thehackernews.com/2026/07/new-bad-epoll-linux-kernel-flaw-lets.html
Post summary
A newly disclosed Linux kernel use‑after‑free flaw (CVE‑2026‑46242, "Bad Epoll") can grant local users root privileges; no active exploitation or patch information has been noted.
🔴 Bad Epoll (CVE-2026-46242): Linux 6.4+ çekirdeklerde epoll alt sistemini etkileyen Use-After-Free race condition açığı. İki farklı temizleme yolunun aynı kernel nesnesine eşzamanlı erişmesi sonucu serbest bırakılmış nesne üzerinde bellek bozulması oluşturulabiliyor ve düşük yetkili bir kullanıcı root yetkisi elde edebiliyor. Açık, Jaeyoung Chung tarafından keşfedildi; aynı kod bölgesindeki farklı bir hatayı daha önce Anthropic'in Mythos modeli tespit etmişti. Araştırmacının testlerinde yaklaşık %99 başarı oranına ulaşan PoC yayımlandı ve Chrome renderer sandbox'ından tetiklenebildiği belirtiliyor. PoC: https://github.com/J-jaeyoung/bad-epoll
Post summary
Bad Epoll (CVE‑2026‑46242) is a use‑after‑free race condition that can lead to root escalation, and a functional PoC with ~99% success has been published on GitHub, though no active exploitation or patch is reported.
We have two patched kernels ready for testing: Januscape (CVE-2026-53359) and Bad Epoll (CVE-2026-46242). Januscape affects every supported AlmaLinux release (8, 9, and 10). Bad Epoll affects AlmaLinux 9 and 10. Learn more ⤵️ https://almalinux.org/blog/2026-07-06-januscape-bad-epoll/?utm_medium=social&utm_source=twitter
Post summary
AlmaLinux has released patched kernels for CVE-2026-53359 and CVE-2026-46242 and encourages testing, linking to a blog for further information.
A critical Bad Epoll vulnerability (CVE-2026-46242) allows local users to gain root access on Linux and Android devices. Patch your systems immediately. #LinuxSecurity #BadEpoll #CyberSecurity #ZeroDay #CVE202646242 http://meterpreter.org/bad-epoll-vulnerability/
Post summary
A critical CVE‑2026‑46242 Bad Epoll flaw is disclosed, enabling local privilege escalation on Linux and Android, with an urgent patch recommendation linked to a resource.
Bad Epoll (CVE-2026-46242) : un utilisateur local sans privilège devient root sur Linux… et Android. Les détails 👇 https://www.it-connect.fr/bad-epoll-faille-noyau-linux-android-acces-root/ #linux #infosec https://t.co/RJIgql5eOt
Post summary
A new local privilege‑escalation vulnerability (CVE‑2026‑46242) has been disclosed, allowing a non‑privileged user to gain root access on Linux and Android systems.
CVE-2026-46242,Bad Epoll: Linux kernel: ep_remove struct eventpoll / struct file UAF https://www.openwall.com/lists/oss-security/2026/07/08/13 local privilege escalation on Linux, including Android https://x.com/J_jaey0ung/status/2069768411455070602
Post summary
The tweet announces CVE‑2026‑46242, a Linux kernel use‑after‑free vulnerability that enables local privilege escalation on Linux and Android.
CVE from today: https://lore.kernel.org/linux-cve-announce/2026053014-CVE-2026-46242-8394@gregkh/T/#u Upstream 6.6/6.12 still not fixed almost a month later (what they're supposedly delaying the CVEs for) https://t.co/M3LNXqZASo
Post summary
The tweet announces a newly identified CVE (CVE-2026-46242) and notes that the kernel versions 6.6/6.12 remain unfixed even after a month, providing no exploit details or mitigation advice.
Androidにも刺さるLinuxの権限昇格/カーネル脆弱性Bad Epoll (CVE-2026-46242)について。解放後メモリ使用。Chromeのレンダラーサンドボックス内からも使える。緩和策は無いので、上流パッチ/バックポートを待つしかない。 https://cybersecuritynews.com/bad-epoll-0-day-vulnerability/
Post summary
The post discloses a new Linux kernel privilege‑escalation flaw (CVE‑2026‑46242) affecting Android, capable of being triggered after memory release and usable from Chrome’s renderer sandbox, with no mitigation currently available beyond awaiting an upstream patch.
Adminów Linuxa wpadających w tryb wakacyjny na pewno ucieszy wiadomość o nowym exploicie na Linuxa (local privilege escalation), bez workarounds https://ubuntu.com/security/CVE-2026-46242
Post summary
The post announces a new Linux local privilege escalation vulnerability (CVE‑2026‑46242) that has no available workarounds.
🚨 Acaba de confirmarse: un nuevo fallo en el núcleo de Linux llamado Bad Epoll (CVE-2026-46242) permite a un usuario no privilegiado obtener acceso de root en máquinas Linux y Android. El fallo, identificado como CVE-2026-46242, afecta a kernels Linux 6.4+ y se debe a una condición de carrera *use-after-free* en el subsistema eventpoll/epoll. Esto permite a un atacante explotar la vulnerabilidad de forma fiable (~99% de éxito) desde el sandbox de Chrome y potencialmente en Android. La vulnerabilidad puede ser explotada por usuarios sin privilegios, lo que significa que cualquier usuario con acceso a la máquina puede obtener acceso de root. Esto puede tener consecuencias graves, como la pérdida de control sobre la máquina y el acceso a datos sensibles. Ya se ha publicado una solución para este problema, por lo que es importante que los administradores de sistemas y los dueños de dispositivos Android actualicen sus sistemas lo antes posible. ¿Estás en riesgo? Revisa esto: asegúrate de actualizar tu kernel Linux y dispositivo Android con la última versión disponible. #Ciberseguridad #CVE #SeguridadDigital #PYMEsMX https://thehackernews.com/2026/07/new-bad-epoll-linux-kernel-flaw-lets.html
Post summary
A new Linux kernel flaw (CVE‑2026‑46242), a use‑after‑free race condition in epoll, can grant unprivileged users root access; a fix is available and users should update immediately.
Three high-profile Linux kernel studies published recently Within a short period, three independent research projects were released as part of Google CTF's program, each focused on critical flaws in core Linux subsystems: GhostLock (CVE-2026-43499 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-43499)) — a vulnerability in the futex priority inheritance ("rt_mutex") mechanism. A logic flaw in the waiter cleanup routines leads to a stack use-after-free: the kernel continues to operate on an object that has already been freed from the stack. The researchers turned this primitive into a nearly reliable local privilege escalation (LPE) and container escape (≈97% success rate). The bug had existed for about 15 years and was discovered through Google kernelCTF. PT ID: PT-2026-42456 https://dbugs.ptsecurity.com/vulnerability/PT-2026-42456 Bad Epoll (CVE-2026-46242 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-46242)) — a synchronization bug in the "epoll" subsystem causes a heap use-after-free. Despite the race window being only a few instructions long, the researchers developed a nearly ≈99% reliable exploit for local privilege escalation on Linux and Android. This work was also conducted under Google kernelCTF. Januscape (CVE-2026-53359 -> (https://dbugs.ptsecurity.com/vulnerability/CVE-2026-53359)) — a use-after-free vulnerability in KVM Shadow MMU. KVM continues to use a Shadow MMU object after it has been freed, allowing a guest VM to modify Shadow MMU data and execute code in the host kernel context. Unlike the previous two, this is a VM escape, rather than a classic LPE. The research was part of Google kvmCTF. Article 1 (GhostLock): https://nebusec.ai/research/ionstack-part-2/ Article 2 (BadEpoll): https://github.com/J-jaeyoung/bad-epoll Article 3 (Januscape): https://github.com/V4bel/Januscape #dbugs_attacks
Post summary
The text announces three Linux kernel CVEs, provides explicit links to exploit code repositories, and details technical vulnerabilities, indicating that functional exploits are available and the research is public.
A race condition. 6 instructions wide. 99% success rate. Root from any unprivileged user. CVE-2026-46242, "Bad Epoll." Every Linux server, desktop, and Android device on kernel 6.4+. Thread 🧵👇 https://t.co/cBjhzlrped
Post summary
The tweet announces a race condition in epoll (CVE‑2026‑46242) affecting Linux 6.4+ and Android, noting its high success rate and ability to gain root, but offers no PoC or patch details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | linux | linux_kernel | - | - | - |