It is possible to exploit the Linux kernel vulnerability “Bad Epoll” (CVE-2026-46242) in practice, according to a research team led by Professor Byoungyoung Lee of the Systems and Software Security Laboratory in the Department of Electrical and Computer Engineering at Seoul National University College of Engineering.
The researchers submitted the vulnerability to kernelCTF, Google’s security reward program, successfully achieved root privilege escalation, and received a $92,337 bounty from Google.
The Linux kernel serves as a core foundation for a wide range of systems, including servers, personal computers, and Android smartphones. If an attacker gains root privileges at the kernel level, they can access critical system resources, bypass security mechanisms, and arbitrarily alter system behavior.
The vulnerability occurs in epoll, a core Linux kernel feature.
Bad Epoll
Epoll should efficiently handle input and output events generated by multiple programs and devices, and a wide range of system components, including operating systems, network services, and browsers, depend on it.
Bad Epoll is a race condition-based use-after-free vulnerability in epoll. A race condition is an error that occurs when multiple CPUs or threads process the same kernel object simultaneously and their execution order becomes interleaved in an unintended way.
In the case of Bad Epoll, when two interconnected epoll objects close simultaneously, one CPU writes a value into a memory region already freed by another CPU, resulting in a use-after-free error. An attacker can exploit this flaw to gain the ability to read and write kernel memory and ultimately obtain administrator, or root, privileges.
The research team demonstrated through Google kernelCTF that Bad Epoll was a genuinely exploitable Zero Day vulnerability, achieving a 99 percent success rate.
Screen demonstrating successful acquisition of administrator (root) privileges by exploiting the Bad Epoll vulnerability.
Source: Seoul National University College of Engineering
The team submitted Bad Epoll to kernelCTF before the vulnerability ended up publicly disclosed or fixed and successfully obtained root privileges in a Linux server environment designated by Google. KernelCTF is a security reward program in which researchers must go beyond simply finding and reporting a vulnerability and demonstrate Linux kernel privilege escalation using a working exploit before their achievement ends up recognized.
Significant Risk
Unlike many typical Linux kernel vulnerabilities, Bad Epoll poses a significant risk because it can potentially end up exploited on Android devices as well. Quite a few Linux kernel privilege-escalation vulnerabilities arise in optional features not used by Android, whereas epoll – the component affected by Bad Epoll – is a core feature widely used on Android.
In this respect, Bad Epoll is a relatively rare case. Among approximately 130 vulnerabilities whose exploitability ended up demonstrated through Google kernelCTF, only around 10 could be candidates for Android privilege escalation, and Bad Epoll is one of them.
Additionally, Bad Epoll can end up triggered from within the Chrome browser’s renderer sandbox, meaning, if combined with a separate browser vulnerability, it could potentially end up used in an attack scenario launched through a webpage.
The achievement is also significant because the researchers were able to reliably reproduce a race-condition vulnerability that would otherwise have an extremely low probability of successful exploitation.
In Bad Epoll, the window in which the two operations can collide is extremely brief, spanning only about six machine instructions, making it difficult to precisely hit the required timing using conventional methods. The team overcame this limitation by using interrupts to artificially widen the potential collision window and applying a technique that repeatedly retries the exploit without crashing the system when an attempt fails.
The vulnerability is also notable because human researchers identified an additional high-risk flaw in code that had already been analyzed by a state-of-the-art AI model.
Difficult to Identify
A modification introduced into the epoll code in 2023 created two distinct race conditions. One of them ended up discovered by Mythos, an AI model from Anthropic, and reported as CVE-2026-43074. Bad Epoll, however, remained undetected in the same area of code. The research team analyzed Bad Epoll may have been particularly difficult to identify because its race window is extremely narrow and the flaw is not readily detected even by KASAN (Kernel Address Sanitizer), a widely used tool for detecting kernel memory errors.
It also took two months to fully and correctly fix the vulnerability.
The research team reported Bad Epoll to the Linux kernel security team on February 17, 2026. When the developers’ initial patch failed to fully resolve the issue, the researchers analyzed the remaining problem and submitted an additional report. The final patch ended up incorporated into the Linux mainline kernel on April 24, 2026. Users of potentially affected Linux and Android devices should install the latest security updates provided by their device manufacturers or Linux distributions.
“As AI technology advances rapidly, the way we detect vulnerabilities and conduct security research is also changing significantly,” Lee said. “However, in complex systems, in-depth analysis and new perspectives remain essential for discovering emerging security threats and determining their real-world risks.
“We plan to continue conducting research that proactively addresses new security threats emerging in the AI era and improves the security of real-world systems,” he said.