Linux kernel eventpoll use-after-free local privilege escalation
Use-after-free in Linux kernel eventpoll allows local privilege escalation via concurrent ep_free() race. CVSS 7.8. Found by Anthropic's Mythos AI; patched.
- Vendor
- Linux Foundation
- Product
- Linux kernel (eventpoll subsystem)
- CVSS
- 7.8
- EPSS (exploit probability)
- 0.2%
- Status
- patched
- Published
Is CVE-2026-43074 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-43074 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.2% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
In ep_free() inside eventpoll.c, the epi->ep struct can be freed while a concurrent thread still holds a reference to it, producing a use-after-free. The upstream fix defers the kfree() call to an RCU callback so no thread can access the struct after it has been released. An unprivileged local user can exploit this race to escalate to root.
CVE-2026-43074 was discovered by Anthropic’s Mythos automated vulnerability-discovery system — the same epoll code path where Bad Epoll (CVE-2026-46242) was later found by Jaeyoung Chung via Google’s kernelCTF program. Mythos caught CVE-2026-43074 during a research push in May 2026; Bad Epoll, in the same subsystem, was reported in July. The two bugs are separate flaws in adjacent code paths, both requiring local access.
NVD published the CVE on 2026-05-06. CVSS 7.8 (high). No KEV listing; no confirmed in-the-wild exploitation at time of publication. Apply your distro’s kernel security update; the upstream fix is in the stable tree. NVD record.
Other Linux Foundation CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-53166 Linux kernel crash regression from GhostLock fixwrite-up | [ MEDIUM ] | 5.5 | — | — |
| CVE-2026-43499 Linux kernel futex priority-inheritance use-after-free ('GhostLock')write-up | [ HIGH ] | 7.8 | 0.8% | — |
| CVE-2026-53359 Linux KVM shadow-MMU use-after-free — guest-to-host escape (Januscape)write-up | [ HIGH ] | 8.8 | 1.0% | — |
| CVE-2026-46242 Linux kernel epoll use-after-free local privilege escalation ('Bad Epoll')write-up | [ HIGH ] | — | 4.4% | — |
