A public exploit is now available for a Linux kernel bug that can let a normal local user gain full root control of a device. The flaw, CVE-2026-46242, is a race-condition use-after-free issue in epoll, the kernel's I/O event notification subsystem. It affects Linux distributions using kernel 6.4 or newer and was also confirmed on Pixel 10 devices running kernel 6.6. The published proof of concept shows privilege escalation through kernel memory leakage and a return-oriented programming, or ROP, chain.
Why it matters: Public exploit code makes this bug much easier for attackers and red teams to weaponize on vulnerable Linux systems and affected Android devices. Organizations and users running affected kernels should prioritize vendor patches and limit untrusted local code execution until updates are applied.
Ionut Arghire
2026.07.06
100% relevant
This article establishes a distinct story because it centers on CVE-2026-46242 ('Bad Epoll') and the new publication of technical details and proof-of-concept exploit code, which is not the same underlying event as the already tracked Linux kernel flaws such as PinTheft, CIFSwitch, or CVE-2026-46333.
← Back to all stories