A newly disclosed Linux kernel vulnerability called "Bad Epoll" lets an unprivileged process become root on Linux desktops, servers, and Android devices. The bug, tracked as CVE-2026-46242, was found and exploited by security researcher Jaeyoung Chung and submitted to Google's kernelCTF program, which pays out $71,337 or more for working Linux kernel exploits. What makes the story notable beyond the exploit itself is where the bug was found: in the same small stretch of code where Anthropic's Mythos AI model had already discovered a related race condition and missed this one entirely.

What is Bad Epoll? Bad Epoll is a race-condition use-after-free (UAF) in the Linux kernel's epoll subsystem, the mechanism the kernel uses to let programs monitor many file descriptors at once. A single 2023 commit introduced two separate race conditions into roughly 2,500 lines of epoll code. Both are critical bugs capable of privilege escalation. Anthropic's Mythos found the first one. Jaeyoung Chung found the second, Bad Epoll, and turned it into a reliable root exploit.

One Bug Found by AI, One Bug It Missed

Anthropic's Mythos AI model previously discovered a race condition in the same epoll code, reported and fixed as CVE-2026-43074. An independent researcher later published a working exploit for that bug on kernelCTF. Finding it at all was notable, since race conditions are notoriously difficult bugs to locate through manual or automated review, and the result demonstrated that a frontier AI model can find real kernel race bugs.

But the same 2023 commit introduced a second race condition, sitting in the same function, that Mythos did not flag. According to the researcher's write-up, two factors likely made Bad Epoll especially hard to spot: the race window is only about six instructions wide, making the exact thread interleaving difficult to reason about even when reading the vulnerable code directly, and the resulting use-after-free typically does not trigger KASAN, the kernel's primary memory-error detector, once the first bug is patched. Without a clear runtime signal, the model may not have had enough confidence to flag it as an exploitable issue.

Why this one matters more than most kernel bugs: Out of roughly 130 vulnerabilities exploited on Google's kernelCTF to date, only about ten are viable candidates for rooting Android. Bad Epoll is one of them. It can also be triggered from inside Chrome's renderer sandbox, a path that blocks almost every other kernel bug, meaning it could theoretically be chained with a browser renderer exploit to reach kernel code execution. Unlike some rooting bugs, epoll cannot simply be disabled or blacklisted as a kernel module; it is a core feature that the OS, network services, and browsers all depend on, so there is no kill-switch short of applying the patch.

A Six-Instruction Race Window, 99% Reliable

The vulnerability comes from two of epoll's close paths running concurrently: one frees an object while the other is still writing into it. On its own, that race window is so narrow that a normal attempt would almost never hit it. The published exploit widens the window using a timer-driven technique and loops the attempt without ever crashing the kernel, reaching a reported 99% success rate on Google's kernelCTF LTS target and 98% on the COS target.

Diagram of the Bad Epoll race condition showing two epoll close paths colliding to trigger a use-after-free
A diagram of the race: closing two linked epoll objects at the same moment triggers a use-after-free that an exploit can turn into a root shell.

From there, the exploit converts an 8-byte use-after-free write into a use-after-free on a file object, uses a cross-cache attack to gain full control of that file's contents, obtains an arbitrary kernel memory read through /proc/self/fdinfo, and finally hijacks control flow with a return-oriented-programming (ROP) chain to spawn a root shell.

Fixing It Was Hard Too

The bug proved difficult to patch correctly. Chung first reported it to [email protected] in February 2026. Maintainers proposed a fix prototype the same day, but it did not fully resolve the issue and the discussion stalled. A correct patch did not land until late April, roughly two months after the initial report, an unusually long turnaround for a kernel security issue.

Date Event
2023-04-08 The bug is introduced into epoll (commit 58c9b016e128).
2026-02-17 Reported to [email protected]; maintainers' first patch prototype does not fully fix the issue and discussion stalls.
2026-04-02 Fix for the bug Mythos found (CVE-2026-43074) lands in mainline.
2026-04-22 The remaining issue is re-reported to maintainers.
2026-04-24 Fix for Bad Epoll (commit a6dc643c6931, CVE-2026-46242) lands in mainline.

Affected Systems and What to Do

Because epoll cannot be disabled, there is no workaround short of patching. Distributions running kernels based on v6.4 or newer that have not yet backported upstream commit a6dc643c6931 are potentially affected; kernels based on v6.1 or earlier are not, since the bug was introduced in v6.4.

The public exploit currently targets kernelCTF's lts-6.12.67 and cos-121-18867.294.100 images. An Android root exploit is reportedly still in progress: the proof of concept triggers the underlying use-after-free on Pixel 10 (kernel v6.6+), but a full working root chain for Android has not yet been released. Pixel 8 and other devices on v6.1-based kernels are not affected.

Sources

  • Bad Epoll project README, root-cause analysis, and exploit write-up by Jaeyoung Chung: GitHub
  • NVD entry for CVE-2026-46242: NVD
  • Upstream kernel fix commit a6dc643c6931: git.kernel.org
  • Anthropic, on assessing Claude Mythos Preview's cybersecurity capabilities: Anthropic

This article was written by DigitalEscapeTools based on the researcher's published write-up, official CVE records, and the upstream kernel commit history at the time of publication.