A newly disclosed flaw in the Linux kernel lets unprivileged users gain root access, as detailed by SecurityOnline.
The flaw is tracked as CVE-2026-46242 and nicknamed Bad Epoll.
It resides in the epoll subsystem and can be triggered by a local attacker without any special privileges.
Proof‑of‑concept code has been made public, demonstrating reliable privilege escalation on affected systems, and the issue impacts Linux distributions shipping kernel 6.4 or newer and certain Android builds that share the same kernel base.
The vulnerability is scored CVSS 7.8 HIGH and details can be found in the NVD entry.
It stems from a race condition use‑a‑free error when two kernel threads attempt to release the same epoll object during file descriptor cleanup.
The object can be freed twice, allowing an attacker to manipulate freed memory and execute arbitrary kernel code with root privileges.
A related flaw, CVE-2026-53362, was disclosed simultaneously and involves an IPv6‑related use‑a‑free that can lead to container‑to‑host escape.
Despite the availability of a working exploit, no instances of active exploitation have been detected in the wild as of the latest reports.
The public proof‑of‑concept, shared by researcher Jaeyoung Chung, achieves a success rate exceeding 99 % in test environments (GitHub).
No specific threat actor has been linked to the flaw, but the low complexity of the exploit raises concern for widespread misuse.
Organizations should treat the issue as a high priority for patching.
Patches have been issued by the upstream kernel community and integrated into the stable releases 6.4.12, 6.5.7 and 6.6.2, among others,