Bad EPoll: CVE-2026-46242 Linux Root Exploit Explained

A newly disclosed Linux kernel flaw, "Bad EPoll" (CVE-2026-46242), lets an unprivileged local user escalate to full root access in as little as six machine instructions — with roughly a 99% success rate when the timing window is deliberately widened. The bug is a use-after-free race condition in the kernel's epoll subsystem: two kernel threads try to clean up the same memory object at once, one freeing it while the other writes to it, corrupting kernel data. It affects desktops, servers, and Android devices running Linux 6.4+ kernels, and can even be triggered from inside Chrome's rendering sandbox, bypassing many standard kernel protections.

In this episode of CISSP Cyber Training, host Shon Gerber breaks down how the vulnerability works and ties it directly to Domain 8 (Software Development Security) — walking through why SAST, DAST, and even AI-assisted code review (including a case where Anthropic's model caught a different bug in the same code but missed this one) all fell short of catching it. He closes with practical guidance for security leaders: layered detection instead of single-tool reliance, patch timelines measured in days rather than months, and verification steps to confirm a fix actually closes the hole.

Links

Podcast: CISSP Cyber Training Podcast

Related articles on Bad EPoll / CVE-2026-46242:

• The Hacker News – New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
• SecurityWeek – Proof-of-Concept Exploit Released for Linux 'Bad Epoll' Root Access Vulnerability
• Security Affairs – Bad Epoll Flaw Gives Attackers Root Access on Linux and Android
• TuxCare – Understanding Bad Epoll, a Use After Free That Roots Linux and Android
• Threat-Modeling.com – CVE-2026-46242 'Bad Epoll': Linux Kernel 0-Day Local Privilege Escalation to Root
• TechTimes – Bad Epoll: Kernel Race Bug Beats AI Auditing, Hits 99% Root Exploit Rate