Critical Bad Epoll Vulnerability Allows Root Access on Linux and Android Devices

A newly disclosed Linux kernel vulnerability, identified as CVE-2026-46242, allows unprivileged local users to escalate privileges to root on Linux servers, desktops, and Android devices. Dubbed 'Bad Epoll', this flaw arises from a race condition and a use-after-free (UAF) in the kernel’s epoll subsystem, specifically in the ep_remove() function. The vulnerability was published on May 30, 2026, and poses a significant risk due to its potential for exploitation across multiple platforms. Users and administrators are advised to monitor for updates and apply necessary patches to mitigate risks. The flaw affects a wide range of Linux distributions and Android versions, making it critical for both server and mobile environments. Current status indicates that the vulnerability is known but not yet confirmed to be actively exploited in the wild.

Key Points: • CVE-2026-46242 allows unprivileged users to gain root access on Linux and Android. • The vulnerability stems from a race condition and use-after-free in the epoll subsystem. • Published on May 30, 2026, it affects various Linux distributions and Android devices.