CVE-2026-46242
eventpoll: fix ep_remove struct eventpoll / struct file UAF
Description
In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays.
INFO
Published Date :
May 30, 2026, 1:16 p.m.
Last Modified :
July 9, 2026, 1:19 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the patched version.
- Reboot the system after applying the update.
- Verify the kernel version is updated.
Public PoC/Exploit Available at Github
CVE-2026-46242 has a 9 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-46242.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-46242 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-46242
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Evidence-first tracker for vulnerabilities claimed to be difficult for AI security systems to discover.
ai-security benchmark github-pages security-research vulnerability-research
JavaScript HTML CSS
CVE-2026-46242
C
Verificador de Vulnerabilidad: Bad Epoll (CVE-2026-46242)
Shell
CVE-2026-46242
C
Full Weaponized LPE Toolkit 2026
exploit linux-privilege-escalation privilage-escalation rootkit toolkit
C
Daily tech-watch digest (AI, dev, DevOps, data, cloud). Auto-published from my watch on baptisteblouin.fr
ai artificial-intelligence automation cloud cloudflare-workers data-engineering devops digest github-actions llm machine-learning mlops newsletter rss tech-news tech-watch ai-news
JavaScript
None
Setup instructions for my personal home AI server
Shell Python
A zipped Linux container runtime that zips (Lightweight User-friendly Linux-container Implementation)
chroot container linux linux-container rootfs unshare
C Makefile Python Shell M4 CMake
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-46242 vulnerability anywhere in the article.
-
The Hacker News
15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
Researchers at Nebula Security have disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw that lets any logged-in user take full root control of a machine that has not been patched. Th ... Read more
-
The Hacker News
New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access take full control of a machine as root. It affects Linux desktops, servers, and Andro ... Read more
The following table lists the changes that have been made to the
CVE-2026-46242 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Jul. 09, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/07/08/14 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 04, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/2de4db145b2992da496fea6c51f9839be678ae24 Added Reference https://git.kernel.org/stable/c/9324de74a3a59b9fde9b62ee45ebaa71458ba2e5 Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ef4ca02e95363e78977ca04340d44fe3b4b2b81f', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ced39b6a8062bac5c18a1c3df85634107eb8664a', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'a6dc643c69311677c574a0f17a3f4d66a5f3744b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f2451def095c1743adcfcb0cb5dadc86034e162a', 'versionType': 'git'}, {'status': 'affected', 'version': 'a1f93804449d13f97dabd4b996817de4bf1ed67a', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.209', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.175', 'lessThan': '6.2', 'versionType': 'semver'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': '2de4db145b2992da496fea6c51f9839be678ae24', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': '9324de74a3a59b9fde9b62ee45ebaa71458ba2e5', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ef4ca02e95363e78977ca04340d44fe3b4b2b81f', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ced39b6a8062bac5c18a1c3df85634107eb8664a', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'a6dc643c69311677c574a0f17a3f4d66a5f3744b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f2451def095c1743adcfcb0cb5dadc86034e162a', 'versionType': 'git'}, {'status': 'affected', 'version': 'a1f93804449d13f97dabd4b996817de4bf1ed67a', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.209', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.175', 'lessThan': '6.2', 'versionType': 'semver'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ef4ca02e95363e78977ca04340d44fe3b4b2b81f', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'ced39b6a8062bac5c18a1c3df85634107eb8664a', 'versionType': 'git'}, {'status': 'affected', 'version': '58c9b016e12855286370dfb704c08498edbc857a', 'lessThan': 'a6dc643c69311677c574a0f17a3f4d66a5f3744b', 'versionType': 'git'}, {'status': 'affected', 'version': 'f2451def095c1743adcfcb0cb5dadc86034e162a', 'versionType': 'git'}, {'status': 'affected', 'version': 'a1f93804449d13f97dabd4b996817de4bf1ed67a', 'versionType': 'git'}, {'status': 'affected', 'version': '5.15.209', 'lessThan': '5.16', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.1.175', 'lessThan': '6.2', 'versionType': 'semver'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.4'}, {'status': 'unaffected', 'version': '0', 'lessThan': '6.4', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/eventpoll.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jun. 10, 2026
Action Type Old Value New Value Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.209 up to (excluding) 5.16 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.175 up to (excluding) 6.2 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.4 up to (excluding) 6.18.33 Added Reference Type kernel.org: https://git.kernel.org/stable/c/a6dc643c69311677c574a0f17a3f4d66a5f3744b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ced39b6a8062bac5c18a1c3df85634107eb8664a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ef4ca02e95363e78977ca04340d44fe3b4b2b81f Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 05, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 30, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: eventpoll: fix ep_remove struct eventpoll / struct file UAF ep_remove() (via ep_remove_file()) cleared file->f_ep under file->f_lock but then kept using @file inside the critical section (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). A concurrent __fput() taking the eventpoll_release() fastpath in that window observed the transient NULL, skipped eventpoll_release_file() and ran to f_op->release / file_free(). For the epoll-watches-epoll case, f_op->release is ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which kfree()s the watched struct eventpoll. Its embedded ->refs hlist_head is exactly where epi->fllink.pprev points, so the subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed kmalloc-192 memory. In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot backing @file could be recycled by alloc_empty_file() -- reinitializing f_lock and f_ep -- while ep_remove() is still nominally inside that lock. The upshot is an attacker-controllable kmem_cache_free() against the wrong slab cache. Pin @file via epi_fget() at the top of ep_remove() and gate the critical section on the pin succeeding. With the pin held @file cannot reach refcount zero, which holds __fput() off and transitively keeps the watched struct eventpoll alive across the hlist_del_rcu() and the f_lock use, closing both UAFs. If the pin fails @file has already reached refcount zero and its __fput() is in flight. Because we bailed before clearing f_ep, that path takes the eventpoll_release() slow path into eventpoll_release_file() and blocks on ep->mtx until the waiter side's ep_clear_and_put() drops it. The bailed epi's share of ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() in ep_clear_and_put() cannot free the eventpoll out from under eventpoll_release_file(); the orphaned epi is then cleaned up there. A successful pin also proves we are not racing eventpoll_release_file() on this epi, so drop the now-redundant re-check of epi->dying under f_lock. The cheap lockless READ_ONCE(epi->dying) fast-path bailout stays. Added Reference https://git.kernel.org/stable/c/a6dc643c69311677c574a0f17a3f4d66a5f3744b Added Reference https://git.kernel.org/stable/c/ced39b6a8062bac5c18a1c3df85634107eb8664a Added Reference https://git.kernel.org/stable/c/ef4ca02e95363e78977ca04340d44fe3b4b2b81f