Linux kernel epoll use-after-free local privilege escalation ('Bad Epoll')
A use-after-free race condition in the Linux kernel's epoll subsystem (introduced by a 2023 code change and present in Linux 6.4 and newer) allows an unprivileged local user to escalate to root. Older 6.1-based kernels are not affected. Reported by Jaeyoung Chung as a zero-day submission to Google's kernelCTF program; upstream fix landed as commit a6dc643c6931. Android devices running affected kernels are also in scope; no in-the-wild exploitation has been reported and the flaw is not on CISA KEV.
- Vendor
- Linux Foundation
- Product
- Linux kernel (6.4 and newer; some Android device kernels)
- CVSS
- N/A
- EPSS (exploit probability)
- 4.4%
- Status
- patched
- Published
Is CVE-2026-46242 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-46242 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-22 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 4.4% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-22. Full cross-catalog view: /kev-comparison
A use-after-free race condition in the Linux kernel’s epoll subsystem allows an unprivileged local user to escalate privileges to root. The flaw, nicknamed “Bad Epoll,” was introduced by a 2023 code change and affects Linux 6.4 and newer kernels; older 6.1-based kernels are not affected. Android devices running affected kernels are also in scope.
The vulnerability was reported by Jaeyoung Chung as a zero-day submission to Google’s kernelCTF program. An upstream fix landed as commit a6dc643c6931. No in-the-wild exploitation has been reported and the flaw is not on CISA’s Known Exploited Vulnerabilities catalog.
Mitigation: Update to a kernel version that includes the fix commit a6dc643c6931. Check your distribution’s security advisories — most major distributions have backported the fix to their stable kernels. For Android devices, apply OEM security updates as they become available. Full coverage: Bad Epoll — Linux Kernel LPE CVE-2026-46242.
Other Linux Foundation CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-53166 Linux kernel crash regression from GhostLock fixwrite-up | [ MEDIUM ] | 5.5 | — | — |
| CVE-2026-43074 Linux kernel eventpoll use-after-free local privilege escalationwrite-up | [ HIGH ] | 7.8 | 0.2% | — |
| CVE-2026-43499 Linux kernel futex priority-inheritance use-after-free ('GhostLock')write-up | [ HIGH ] | 7.8 | 0.8% | — |
| CVE-2026-53359 Linux KVM shadow-MMU use-after-free — guest-to-host escape (Januscape)write-up | [ HIGH ] | 8.8 | 1.0% | — |
