Tiny Linux Kernel Race Opens Root on Desktops and Android
A local bug is enough here to take over the whole device. The exploit stretches a tiny race in the kernel until it becomes reliable root access, so browser sandboxes and app-level permissions do not count as a boundary once code can reach epoll.
The flaw is CVE-2026-46242, a use-after-free race in Linux kernel epoll code. The article says a researcher built a working exploit, the fix is available, and the impact reaches Linux desktops, servers, Chrome renderer sandboxes, and Android.
Epoll cannot be turned off, and the timing window is so small that normal attempts rarely hit it. A reliable exploit against that kind of bug gives attackers a path from low privilege to kernel control before human defenders notice the race exists.