“Bad Epoll” Linux kernel flaw can give local users root.
A newly disclosed Linux kernel vulnerability, CVE-2026-46242, called Bad Epoll, allows an unprivileged local user to gain root on affected Linux systems and potentially Android. The flaw is a use-after-free race condition in epoll code, affecting kernels based on Linux 6.4 or newer unless patched. The researcher who found it built a working exploit and reported roughly 99% success on tested systems, although there is no sign of active exploitation in the wild yet. The bug matters because epoll is core infrastructure used by servers, browsers, and network services, so it cannot simply be disabled. Administrators should apply the upstream fix or distribution backports as soon as available