New

Summary: A Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access escalate to root on Linux desktops, servers, and Android, and a fix is out. Researcher Jaeyoung Chung built a working exploit that widens the roughly six-instruction race window and reaches root about 99% of the time on tested systems, and he submitted it as a zero-day to Google's kernelCTF program.
Why it matters: By Chung's account the bug can be triggered from inside Chrome's renderer sandbox and reaches Android, and because epoll cannot be turned off there is no workaround - only upstream commit a6dc643c6931 or a distribution backport.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-31431 CVE-2026-31694 CVE-2026-43074 CVE-2026-46242
Related: 15-Year-Old Ghost Lock Flaw Enables Root and Container Escape on Most Linux Distros Cyber Risks ·
CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability Known Exploited Vulnerabilities · May 01, 2026
New Linux 'Copy Fail' Vulnerability Enables Root Access on Major Distributions Cyber Risks ·