Bad Epoll: the uso-after-free failure that could scale root privileges on Linux, Android and browsers

The latest Linux kernel failure nicknamed Bad Epoll (CVE-2026-46242) reremember that critical code privilege errors can appear at any time and be extremely dangerous: it allows a normal user without privileges to climb to root on Linux desktop machines, servers and Android, and there is already a patch available.

Bad Epoll is hidden in the subsystem epoll, infrastructure using servers, network services and browsers to monitor many simultaneous connections. Epoll is not an expendable feature, so there is no "lever" to turn it off and avoid risk: the only way out is to park the kernel. The failure is a classic category use-after-free: two ways of the kernel try to release and write on the same object at the same time, which allows to corrupt memory of the kernel and, with exploitation techniques, to raise privileges.

What makes this vulnerability especially interesting for technicians is their career nature: the window where the collision occurs is microscopic, in the order of a few instructions. That means a random attempt rarely works. Researcher Jaeyoung Chung, who discovered the error and built a functional explosion, describes how he expanded that window and added reattempts without causing collisions, successfully climbing to root around 99% in his tests.

There are other factors that increase the real risk: according to Chung, Bad Epoll can be activated from the Chrome renderer sandbox, an environment that usually neutralizes many kernel errors, and also affects Android, which does not always happen with privilege failures. Fortunately, to date there is no public evidence of exploitation in nature: it is not included in the catalogue of vulnerabilities exploited by known actors, but this does not reduce the urgency of the patch.

The correction came in upstream and is identified by the commit a6dc643c6931. The practical recommendation is to apply that commitment or install the backport that publishes your distribution as soon as it is available. Note that the branches of the 6.4 and subsequent kernel are affected unless they already received this correction; the older 6.1 series, and therefore some phones based on 6.1, are not affected because the vulnerable change appeared in 6.4.

From a defensive point of view, do not rely only on detectors in execution time as KASAN to be safe: the corrupt memory that Bad Epoll generates often passes without activating KASAN once the previous related failure was fixed, so the absence of alerts does not imply absence of risk. KASAN documentation can help you understand your limits: KASAN documentation.

For managers and security officials the list of recommended actions is clear: prioritize the application of the patch on exposed servers and on container images, coordinate with Android suppliers and manufacturers to receive patches on devices, and update browsers and sandbox that can be delivery vectors. The CISA catalogue on exploited vulnerabilities is a good reference point for general priority: CISA Known Exploited Vulnerabilities.

Bad Epoll is also useful as a case study on the contribution of artificial intelligence to software security. An advanced model of Anthropic, Mythos, had detected and helped to patch a sister vulnerability in the same area of the code, but ignored it. Chung himself suggests two plausible reasons: the time window is so narrow that it is difficult to visualize it only from the code, and the error produces little evidence in running time after the first patch, which complicates its identification. The practical lesson is that IA can already accelerate the search for failures, but it does not replace human inspection and experimental verification - particularly for subtle career conditions.

Finally, for response equipment and QA it is crucial to deploy reproducible tests and hardening exercises: validate updates in environments that reproduce load behavior, implement building with sanitizers where possible, and restrict the execution of unreliable code in environments that can reach sensitive syscalls. The race bugs are still one of the most difficult to find and correct correctly: Bad Epoll shows that even an initial patch can stay short and that human detection remains determinant to close the gap between "found" and "corrected."