A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets any local user grab full root access on Linux desktops, servers and Android handsets running kernel 6.4 or newer, and reaches inside Chrome's renderer sandbox on the way. A fix has landed upstream, but distributions still have to ship it before servers are safe.
How A Six-Instruction Window Becomes A Root Shell
Bad Epoll is a use-after-free race in Linux's epoll subsystem, the standard interface that lets a program watch many file descriptors or sockets at once. Two kernel paths try to clean up the same internal object at the same time; one frees the memory while the other is still writing into it. The collision lets an attacker corrupt kernel memory and climb from an unprivileged shell up to root.
The window is narrow, about six machine instructions wide, which makes random attempts almost useless. Seoul National University researcher Jaeyoung Chung, who reported the bug through Google's kernelCTF program, wrote an exploit that widens that window and retries without crashing, reaching root about 99 percent of the time on tested systems and 98 percent on Google's COS-121 target.
Why AI Auditing Missed It
The wrinkle is where the bug lives. The same epoll cleanup routine that Anthropic's Mythos AI model flagged earlier this year, netting a fix for CVE-2026-43074, contained a second race. That first patch did not fully address the timing issue, and it took maintainers roughly 66 days to land a correct one. Chung suspects the six-instruction window is simply too tight for the model to see, and once the first bug was patched, the surviving flaw stops tripping KASAN, the kernel's main memory-error detector.
What Sysadmins Should Do Now
Epoll cannot be turned off, and there is no workaround. Kernels built on 6.4 or newer are affected unless they already carry upstream commit a6dc643c6931; older 6.1-based kernels, including some Android handsets like the Pixel 8, are safe because the bug only landed in 6.4. Pixel 10 devices, however, run kernel 6.6 and are in scope. Cloud operators and distribution vendors will need to backport the patch quickly, particularly for hosts that run Chrome renderers or user-facing container workloads. Bad Epoll joins the Bad Binder, Bad IO_uring and Bad Spin family of kernel bugs that have historically become Android rooting tools, dropping alongside Chrome 151's 382 fixes and Adobe's ColdFusion patch storm.
There is no evidence the bug has been exploited in the wild yet. As of publication it is not on CISA's Known Exploited Vulnerabilities catalog, and the only working exploit is the kernelCTF proof of concept. But a public writeup and an in-progress Android chain make that timeline short.
Reporting based on coverage from SecurityWeek, The Hacker News and Tech Times.