CVE-2026-46242, dubbed 'Bad Epoll,' is a race-condition use-after-free vulnerability in the Linux kernel's epoll I/O event notification facility. It occurs when two epoll instances monitoring each other are closed simultaneously, causing one to free an object while the other continues to write to it. This flaw enables local unprivileged users to escalate privileges to root by leaking kernel memory and hijacking control flow via a Return-Oriented Programming (ROP) chain. The vulnerability was introduced in 2023 and affects Linux kernel versions 6.4 and later. The initial patch was incomplete, and a fully correct fix was applied two months after disclosure. Proof-of-concept exploit code has been publicly released, increasing the risk of exploitation. The vulnerability also affects Android devices running affected kernels, such as Pixel 10 with kernel 6.6.

Successful exploitation of this vulnerability allows an unprivileged local attacker to gain root privileges on affected Linux systems, including desktops, servers, and Android devices. This elevates the attacker's control over the system, potentially compromising confidentiality, integrity, and availability. No active exploitation in the wild has been reported at the time of this advisory.

A correct patch for this vulnerability has been released and should be applied promptly. Linux distributions using kernel version 6.4 or newer are affected, so updating to the fixed kernel versions is recommended. Since this is not a cloud service, system administrators must apply the vendor-provided kernel updates manually. Organizations should monitor vendor advisories for their specific distributions to obtain the official patches and instructions. No additional mitigation steps are indicated beyond applying the official fix.