CVE-2026-46242
CVSS 7.8 HIGH: in the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll /… EPSS 3% (87th percentile).
Vulnerabilities & Exploits
A local bug is enough here to take over the whole device. The exploit stretches a tiny race in the kernel until it becomes reliable root access, so browser sandboxes and app-level permissions do not count as a boundary once code can reach epoll.
The flaw is CVE-2026-46242, a use-after-free race in Linux kernel epoll code. The article says a researcher built a working exploit, the fix is available, and the impact reaches Linux desktops, servers, Chrome renderer sandboxes, and Android.
Epoll cannot be turned off, and the timing window is so small that normal attempts rarely hit it. A reliable exploit against that kind of bug gives attackers a path from low privilege to kernel control before human defenders notice the race exists.
2 sources · Jul 6
CVSS 7.8 HIGH: in the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll /… EPSS 3% (87th percentile).
SecurityWeek
Proof-of-Concept Exploit Released for Linux ‘Bad Epoll’ Root Access Vulnerability
Organizations are urged to patch after proof-of-concept code makes the Linux root escalation flaw easier to exploit.
originalThe Hacker News
New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
Bad Epoll (CVE-2026-46242) is a use-after-free race in the Linux kernel that lets a local user gain root on Linux and Android.
originalPart of the PlainSec briefing for 2026-07-04
Every edition of this story: Tiny Linux Kernel Race Opens Root on Desktops and Android