Linux kernel epoll use-after-free local privilege escalation ('Bad Epoll')
A use-after-free race condition in the Linux kernel's epoll subsystem (introduced by a 2023 code change and present in Linux 6.4 and newer) allows an unprivileged local user to escalate to root. Older 6.1-based kernels are not affected. Reported by Jaeyoung Chung as a zero-day submission to Google's kernelCTF program; upstream fix landed as commit a6dc643c6931. Android devices running affected kernels are also in scope; no in-the-wild exploitation has been reported and the flaw is not on CISA KEV.
- Vendor
- Linux Foundation
- Product
- Linux kernel (6.4 and newer; some Android device kernels)
- CVSS
- N/A
- EPSS (exploit probability)
- 3.2%
- Status
- patched
- Published
A use-after-free race condition in the Linux kernel’s epoll subsystem allows an unprivileged local user to escalate privileges to root. The flaw, nicknamed “Bad Epoll,” was introduced by a 2023 code change and affects Linux 6.4 and newer kernels; older 6.1-based kernels are not affected. Android devices running affected kernels are also in scope.
The vulnerability was reported by Jaeyoung Chung as a zero-day submission to Google’s kernelCTF program. An upstream fix landed as commit a6dc643c6931. No in-the-wild exploitation has been reported and the flaw is not on CISA’s Known Exploited Vulnerabilities catalog.
Mitigation: Update to a kernel version that includes the fix commit a6dc643c6931. Check your distribution’s security advisories — most major distributions have backported the fix to their stable kernels. For Android devices, apply OEM security updates as they become available. Full coverage: Bad Epoll — Linux Kernel LPE CVE-2026-46242.
