A newly disclosed Linux kernel vulnerability dubbed "Bad Epoll" (CVE-2026-46242) lets an ordinary, unprivileged user seize full root control of a machine, security researchers revealed this week. The flaw is a use-after-free race condition in the kernel's epoll subsystem — a core mechanism nearly every Linux server and app uses to monitor files and network connections — that traces back to a single code change made in 2023.
Researcher Jaeyoung Chung built a working exploit with a roughly 99% success rate despite an exploitation window of only about six CPU instructions, and demonstrated it can be triggered from inside Chrome's sandboxed renderer process. The bug affects mainline Linux from kernel version 6.4 onward and hits Android devices running 6.6-series kernels or newer, including current Pixel phones; older 6.1-based kernels such as Pixel 8's predate the vulnerable code and are unaffected.
A related epoll flaw (CVE-2026-43074) was discovered earlier this year by Anthropic's "Mythos" AI model and already patched. A fix for Bad Epoll has landed in the mainline kernel as commit a6dc643c6931; it's now up to Linux distributions and device makers to backport and ship it.