A newly published Linux kernel vulnerability, CVE-2026-46242 “Bad Epoll,” gives any unprivileged local user a reliable path to root on systems running kernel versions 6.4 and later. Researcher Jaeyoung Chung discovered the flaw, built a working exploit with a 99% success rate, and submitted it to Google’s kernelCTF programme. The exploit is now public. A patch has been in the upstream kernel mainline since April 24, 2026, but many enterprise distributions have not yet shipped the backport, leaving a significant portion of Linux server infrastructure exposed.
What the Vulnerability Is
Bad Epoll is a race-condition use-after-free in the Linux kernel’s epoll subsystem. Epoll is a core I/O multiplexing mechanism used by virtually every high-performance server application: nginx, Apache, Node.js, Python asyncio, PostgreSQL, Redis, and the Android event loop infrastructure all rely on it. Because epoll is fundamental infrastructure, it cannot be disabled as a workaround. The attack surface is the kernel itself.
The flaw was introduced by a code change committed on April 8, 2023, and shipped in kernel v6.4. Two parts of the kernel’s cleanup path attempt to free the same internal object concurrently. If an attacker can trigger the race, the resulting memory corruption can be weaponised to write into freed kernel memory and escalate to root. The timing window is only six instructions wide, but the exploit Chung built achieves the 99% success rate by spinning additional kernel work to widen it.
Exploitation requires only one thing: the ability to execute code as an ordinary local user. No special privileges, no user namespace manipulation, no non-default configuration. Any attacker who has obtained initial access to a Linux host via any means, including a web shell, a compromised service account, or any other initial-access technique, can use this flaw to achieve full root control.
Android devices running kernel v6.6 or later are also affected, covering primarily Pixel 10 and equivalent 2024-generation flagship hardware.
Why Enterprise Environments Are Specifically at Risk
CVE-2026-46242 is a local privilege escalation, not a remote code execution. Its value in an attack chain depends on what follows initial access. In the context of sectors Adversary Wire covers, that context matters.
Linux servers form the backbone of cloud and on-premises infrastructure across healthcare, finance, telecommunications, and critical national infrastructure. Shared hosting, multi-tenant cloud environments, developer and CI/CD platforms, and any environment where multiple users or services run on the same Linux host are all directly in scope. An initial foothold obtained through a web application vulnerability, a compromised developer account, or lateral movement from an adjacent Windows environment can be immediately converted to full root access on affected systems, removing all remaining defensive barriers.
There is no confirmed exploitation in the wild as of this publication, and the vulnerability has not been added to CISA’s Known Exploited Vulnerabilities catalogue. That window will close. The exploit is publicly available on GitHub. Threat actors, including ransomware affiliates with the technical capability to identify and leverage kernel exploits, have a reliable tool to escalate access on any unpatched Linux host they can reach.
Recommended Actions
Immediate prioritisation: Inventory Linux kernel versions across your server fleet. Hosts running kernel 6.4 or later that have not received a patched distribution update are affected.
Apply available distribution patches: Confirmed fixed packages include current openSUSE Tumbleweed and selected Amazon Linux streams. Ubuntu, Red Hat Enterprise Linux, and Debian are at varying stages of backport delivery; check your distribution’s security advisories for CVE-2026-46242 specifically.
Apply interim hardening where backports are delayed: Linux Security Modules (SELinux and AppArmor) can confine individual services and reduce the effective privilege an attacker can reach even after exploiting the flaw, though they do not prevent exploitation outright. This is a time-limited mitigation only.
Prioritise exposed attack surfaces: Systems accessible to external user input, multi-tenant environments, and CI/CD infrastructure where untrusted code executes should be patched before isolated internal hosts.
The upstream kernel patch is available. The primary operational challenge is the uneven pace of distribution backports and the patch deployment cycle in large server fleets. Organisations running commercial Linux distributions should escalate with their vendors for CVE-2026-46242 patch availability and delivery timelines.