GitHub - J-jaeyoung/bad-epoll

Bad Epoll (CVE-2026-46242) is a race-condition use-after-free vulnerability in the Linux kernel's epoll subsystem, introduced in kernel v6.4 (2023). An unprivileged process can exploit it to gain root access on Linux desktops, servers, and Android devices. The race window is only ~6 instructions wide, yet the exploit achieves 99% reliability by widening the window with a retry loop. Notably, Anthropic's AI model Mythos found a related race bug in the same epoll code path but missed this one. The exploit chains a UAF write into full kernel memory control via a cross-cache attack, arbitrary kernel read through /proc/self/fdinfo, and a ROP chain for root shell. No workaround exists since epoll is a core kernel feature; the only fix is applying upstream commit a6dc643c6931. Kernels v6.4 through the fix date are affected; v6.1-based kernels are not. An Android exploit for Pixel 10 (kernel v6.6+) is in progress.