A Linux kernel vulnerability has been discovered that could allow an attacker with only ordinary user privileges to seize the system’s highest-level administrator, or root, privileges and could also affect the latest Android devices.
A research team led by Professor Byoungyoung Lee of the Systems and Software Security Laboratory in the Department of Electrical and Computer Engineering at Seoul National University College of Engineering discovered the Linux kernel vulnerability “Bad Epoll” (CVE-2026-46242) and demonstrated that it can be exploited in practice. The researchers submitted the vulnerability to kernelCTF, Google’s security reward program, successfully achieved root privilege escalation, and received a $92,337 bounty from Google.
Bad Epoll is particularly notable because it could affect not only Linux desktops and servers but also the latest Android devices, including Galaxy and Pixel devices. The Linux kernel serves as a core foundation for a wide range of systems, including servers, personal computers, and Android smartphones. If an attacker gains root privileges at the kernel level, they can access critical system resources, bypass security mechanisms, and arbitrarily alter system behavior.
The vulnerability occurs in epoll, a core Linux kernel feature. Epoll is used to efficiently handle input and output events generated by multiple programs and devices, and a wide range of system components—including operating systems, network services, and browsers—depend on it.
Bad Epoll is a race condition-based use-after-free vulnerability in epoll. A race condition is an error that occurs when multiple CPUs or threads process the same kernel object simultaneously and their execution order becomes interleaved in an unintended way. In the case of Bad Epoll, when two interconnected epoll objects are closed simultaneously, one CPU writes a value into a memory region that has already been freed by another CPU, resulting in a use-after-free error. An attacker can exploit this flaw to gain the ability to read and write kernel memory and ultimately obtain administrator, or root, privileges.
The research team demonstrated through Google kernelCTF that Bad Epoll was a genuinely exploitable zero-day (0-day) vulnerability, achieving a 99% success rate. A zero-day vulnerability refers to a vulnerability for which defensive measures are not yet available before the flaw becomes publicly known or a security patch is released. The team submitted Bad Epoll to kernelCTF before the vulnerability was publicly disclosed or fixed and successfully obtained root privileges in a Linux server environment designated by Google. KernelCTF is a security reward program in which researchers must go beyond simply finding and reporting a vulnerability and demonstrate Linux kernel privilege escalation using a working exploit before their achievement is recognized.
Unlike many typical Linux kernel vulnerabilities, Bad Epoll poses a significant risk because it can potentially be exploited on Android devices as well. Many Linux kernel privilege-escalation vulnerabilities arise in optional features that are not used by Android, whereas epoll—the component affected by Bad Epoll—is a core feature widely used on Android.
In this respect, Bad Epoll is a relatively rare case. Among approximately 130 vulnerabilities whose exploitability has been demonstrated through Google kernelCTF, only around 10 could be considered candidates for Android privilege escalation, and Bad Epoll is one of them. In addition, Bad Epoll can be triggered from within the Chrome browser’s renderer sandbox, meaning that, if combined with a separate browser vulnerability, it could potentially be used in an attack scenario launched through a webpage.
The achievement is also significant because the researchers were able to reliably reproduce a race-condition vulnerability that would otherwise have an extremely low probability of successful exploitation. In Bad Epoll, the window in which the two operations can collide is extremely brief, spanning only about six machine instructions, making it difficult to precisely hit the required timing using conventional methods. The team overcame this limitation by using interrupts to artificially widen the potential collision window and applying a technique that repeatedly retries the exploit without crashing the system when an attempt fails.
The vulnerability is also notable because human researchers identified an additional high-risk flaw in code that had already been analyzed by a state-of-the-art AI model. A modification introduced into the epoll code in 2023 created two distinct race conditions. One of them was discovered by Mythos, an AI model from Anthropic, and reported as CVE-2026-43074. Bad Epoll, however, remained undetected in the same area of code. The research team analyzed that Bad Epoll may have been particularly difficult to identify because its race window is extremely narrow and the flaw is not readily detected even by KASAN (Kernel Address Sanitizer), a widely used tool for detecting kernel memory errors.
It also took approximately two months to fully and correctly fix the vulnerability. The research team reported Bad Epoll to the Linux kernel security team on February 17, 2026. When the developers’ initial patch failed to fully resolve the issue, the researchers analyzed the remaining problem and submitted an additional report. The final patch was incorporated into the Linux mainline kernel on April 24, 2026. Users of potentially affected Linux and Android devices should install the latest security updates provided by their device manufacturers or Linux distributions.
Professor Byoungyoung Lee, who led the research, said, “As AI technology advances rapidly, the way we detect vulnerabilities and conduct security research is also changing significantly. However, in complex systems, in-depth analysis and new perspectives remain essential for discovering emerging security threats and determining their real-world risks.” He added, “We plan to continue conducting research that proactively addresses new security threats emerging in the AI era and improves the security of real-world systems.”
The study involved graduate students Jaeyoung Chung and Eulgyu Kim of the Department of Electrical and Computer Engineering at Seoul National University. Chung researches offensive and defensive techniques for Linux and Android kernels. At USENIX Security 2026, held in Baltimore, United States, in August 2026, he presented the study “DMGuard: Safeguarding Kernels from Physical-Page Use-After-Free Vulnerabilities” as a co-first author, introducing a method for protecting kernels against a new class of vulnerabilities. He plans to continue research on offensive and defensive techniques targeting real-world systems such as Linux and Android, as well as approaches for responding to security threats in the AI era. Kim conducts research on the automated detection of race conditions in the Linux kernel and has reported more than 20 vulnerabilities to the Linux kernel. In follow-up research, he plans to further advance automated techniques for more effectively identifying complex kernel race conditions and vulnerabilities.
The research was supported by the Institute of Information & Communications Technology Planning & Evaluation (IITP).
□ Introduction to the SNU College of Engineering
Seoul National University (SNU) founded in 1946 is the first national university in South Korea. The College of Engineering at SNU has worked tirelessly to achieve its goal of ‘fostering leaders for global industry and society.’ In 12 departments, 323 internationally recognized full-time professors lead the development of cutting-edge technology in South Korea and serving as a driving force for international development.
Experimental study
Not applicable
The authors declare no conflicts of interest.