New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android

Bad Epoll (CVE-2026-46242) is a use-after-free race in the Linux kernel that lets a local user gain root on Linux and Android. A patch is out; update

The Bad Epoll flaw, designated as CVE-2026-46242, is a use-after-free race in the Linux kernel that allows a local user to gain root access on Linux and Android systems. This vulnerability affects Linux desktops, servers, and Android devices, with a patch already available to mitigate the issue. The flaw was discovered in the epoll subsystem, which is responsible for handling multiple file descriptors. Linux kernel version 5.15 and later are affected, with earlier versions potentially vulnerable as well.

This vulnerability directly affects Android users, as it allows an attacker to gain root access to the device, potentially leading to data theft, malware installation, or other malicious activities. Android device owners may be at risk, particularly those who have not updated their devices recently. The vulnerability could also impact businesses that rely on Linux servers, as a successful exploit could compromise sensitive data. Users of affected devices should update their systems as soon as possible.

The Bad Epoll flaw is not an isolated incident, as Linux kernel vulnerabilities have been a recurring issue in recent years. In 2020, a similar vulnerability, known as CVE-2020-8835, was discovered, allowing local users to gain elevated privileges. The Linux kernel community has been working to improve the security of the kernel, but the complexity of the codebase and the open-source nature of the project make it challenging to identify and fix all vulnerabilities. Insiders know that the Linux kernel is a complex and constantly evolving system.

A fix for the Bad Epoll flaw has been released, and users are advised to update their systems as soon as possible. The Linux kernel community will likely continue to monitor the situation and release additional patches if necessary. On July 15, the Linux kernel maintainers are scheduled to release a new version of the kernel, which may include additional security fixes. Interestingly, the Bad Epoll flaw was discovered by a researcher who was analyzing the Linux kernel code for a different purpose, highlighting the importance of thorough code review and testing.