A newly discovered Linux kernel vulnerability called Bad Epoll (CVE-2026-46242) allows unprivileged users to gain root access by exploiting a use-after-free race condition in the kernel's epoll code, affecting Linux desktops, servers, and Android devices. Researcher Jaeyoung Chung developed a highly reliable exploit that succeeds roughly 99% of the time, and notably can be triggered from within Chrome's renderer sandbox. A fix is available via upstream commit a6dc643c6931, though there is no workaround since epoll cannot be disabled, and an Android-specific exploit remains in development.
