Skip to content
Critical Bad Epoll Vulnerability Grants Root Access to Unprivileged Users

Critical Bad Epoll Vulnerability Grants Root Access to Unprivileged Users

First seen 4 Jul 2026, 03:30 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •July 5, 2026 at 00:19 UTC
  • •Bad Epoll (CVE-2026-46242) allows root access for unprivileged users on Linux systems.
  • •The vulnerability affects kernel versions 6.4 and later, impacting desktops, servers, and Android devices.
  • •A patch has been available since April 24, 2026, but many distributions have not yet backported it.

A newly disclosed Linux kernel vulnerability, named Bad Epoll (CVE-2026-46242), allows unprivileged local users to escalate to root privileges on systems running kernel version 6.4 or later. This use-after-free vulnerability resides in the epoll subsystem, which is critical for I/O event notification in Linux. The flaw affects desktops, servers, cloud workloads, and Android devices. A working exploit has been demonstrated with a 99% success rate, highlighting the severity of the issue. The vulnerability was disclosed on July 3, 2026, but a patch has been available since April 24, 2026, and many distributions have yet to implement it. The incident raises concerns about the effectiveness of AI-assisted security tools, as a prior examination by Anthropic's Mythos failed to identify this flaw. Immediate action is required to mitigate potential exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 99d ago How this analysis works

Timeline

2016-10-21
Public exploit for CVE-2016-5195 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-04-22
CVE-2026-31431 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-04-24
Kernel patch released
A patch for the Bad Epoll vulnerability was included in the kernel mainline.
Techtimes
2026-05-01
CVE-2026-31694 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-06
CVE-2026-43074 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-14
Public exploit for CVE-2026-46300 released
A proof-of-concept exploit appeared on GitHub, lowering the barrier for opportunistic attackers.
GitHub
2026-05-23
CVE-2026-43503 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-05-30
CVE-2026-46242 published
The vulnerability was officially tracked as CVE-2026-46242, detailing its critical nature.
Feeds.4Sysops
2026-07-03
Bad Epoll vulnerability disclosed
The vulnerability was publicly disclosed, revealing its exploitability and impact on various systems.
Techtimes
2026-07-04
Exploit success rate reported
A working exploit for the Bad Epoll vulnerability was demonstrated with a 99% success rate.
Techtimes

More articles in this cluster (17)

Following this threat?

Track CVE-2016-5195 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 4