0xblackash/cve-2026-46242

This repository is a write-up documenting CVE-2026-46242, nicknamed BadEpoll, a security flaw found in the Linux kernel. It does not contain any exploit code or attack tools. Instead, it explains the vulnerability in detail for educational and defensive purposes, so system administrators and security researchers can understand the risk and patch affected systems. The flaw lives in epoll, a part of the Linux kernel that programs use to efficiently wait for events on many file descriptors at once. It is a use after free bug, meaning that under a specific race condition, one piece of code can end up using a chunk of memory that has already been freed and handed back to the system, which can lead to unpredictable behavior. Here, the function that removes an event from epoll's tracking, called ep_remove, clears a pointer to a file object right as another part of the kernel might be closing and freeing that same file at the same time. If the timing lines up wrong, the kernel ends up reading or writing memory it no longer owns. An attacker who already has local access to a machine, meaning they can already run code on it as a regular user, could exploit this race condition to escalate their privileges to a higher level, corrupt kernel memory, or crash the system entirely. It cannot be exploited remotely over a network. The bug affects a range of kernel versions and was fixed upstream by pinning the file object in place before the risky cleanup section runs, closing the race window. The kernel maintainers assigned this a CVSS score of 7.8, considered a high severity issue. The document lists which kernel version ranges are vulnerable and which versions include the fix, along with a simple command to check your own kernel version. As of this writing, there is no public exploit code circulating and no reports of it being used in real attacks, though a patch is already available. The recommended action for anyone running an affected system is to update to a patched kernel release as soon as possible and, in the meantime, limit which local users can run untrusted code on the machine.