A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) allows an ordinary user with no special privileges to take full control of a machine as root. It affects Linux desktops, servers, and Android. A fix is already out.
Bad Epoll sits in the same small stretch of kernel code where Anthropic’s Mythos AI recently found a different bug. The AI caught one flaw and missed this one. Researcher Jaeyoung Chung found it and built a working exploit.
The bug is a use-after-free. Two parts of the kernel try to clean up the same internal object simultaneously. One frees the memory while the other is still writing into it. That brief collision lets an attacker corrupt kernel memory and climb from a normal account to root.
The timing window is tiny — only about six machine instructions wide. Chung’s exploit widens that window and retries without crashing, reaching root about 99% of the time on tested systems.
Two things make it worse. It can be triggered from inside Chrome’s renderer sandbox, which blocks almost every other kernel bug. And it can reach Android, which most Linux privilege bugs can’t.
Chung submitted the flaw as a zero-day to Google’s kernelCTF program. Full technical details are in his public writeup on GitHub. There’s no sign of real-world exploitation yet, and it’s not on CISA’s Known Exploited Vulnerabilities list.
Both bugs trace back to a single 2023 change to the epoll code. The first one Mythos found is tracked as CVE-2026-43074, with a fix that landed earlier in 2026.
Epoll can’t be turned off, so there’s no workaround. Apply upstream commit a6dc643c6931, or install your distribution’s backport when it lands. Kernels built on 6.4 or newer are affected unless already patched. Older 6.1-based kernels, including some Android phones like the Pixel 8, are not — the bug arrived in 6.4.
Bad Epoll joins a well-known family of kernel bugs used to root Android: Bad Binder, Bad IO_uring, Bad Spin. It’s the older, harder kind of bug — a race you have to win, like Dirty Cow from 2016. The counterpoint is clear: race conditions are hard at every stage. Hard to find, even for leading AI. Hard to fix — the first patch fell short, and a correct one took two months. And hard to exploit, through a window only six instructions wide.
