CVE-2026-46242

What it actually does

This is a local Linux kernel use-after-free in the eventpoll/epoll subsystem. A race in ep_remove()/ep_remove_file() can allow a struct file and, in epoll-watches-epoll scenarios, an associated struct eventpoll to be freed while still being used. The vulnerable path can lead to writes into freed kmalloc-192 memory and cache misuse involving SLAB_TYPESAFE_BY_RCU file objects. With local code execution and low privileges, an attacker may be able to corrupt kernel memory, potentially resulting in privilege escalation to root, kernel crash, or arbitrary kernel-code execution depending on exploit reliability and kernel hardening configuration.

Why it matters to the business

A successful exploit can turn a low-privileged local account, compromised service, container workload, or untrusted user process into full control of the affected Linux host. The main operational risks are host takeover, data theft or tampering, disabling security controls, and denial of service through kernel panic. Although it is not listed in CISA KEV and the provided exploit maturity is none, the CVSS score is high and the bug affects the Linux kernel, so exposed multi-user systems, container hosts, CI/CD runners, shared hosting, and servers that run untrusted workloads should be prioritized.

How an attack unfolds

An attacker first obtains the ability to execute code as an unprivileged local user on a vulnerable Linux system. They then create and manipulate epoll file descriptors, including epoll instances that watch other epoll instances, while racing close/release paths against epoll removal operations. In the vulnerable window, ep_remove() clears file->f_ep and continues using the file while another thread can drive __fput() and release/free the underlying eventpoll structure. The attacker attempts to shape kernel heap allocation and reuse so that the stale hlist_del_rcu() write or wrong-cache free corrupts controlled kernel memory. If exploitation is successful, the attacker pivots from memory corruption to privilege escalation, typically by modifying kernel objects or credentials, or causes a kernel crash if the corruption is not controlled. The supplied threat-actor context names “Bad Epoll”; defenders should treat any public or private exploit activity tied to epoll race primitives as relevant.

How to fix it

Upgrade to a kernel version or distribution kernel package that includes the upstream fix for the eventpoll ep_remove use-after-free, described by the patch title “eventpoll: fix ep_remove struct eventpoll / struct file UAF.” No exact fixed versions were provided in the input, so use the fixed kernel releases published by the applicable Linux distribution or kernel vendor. Where immediate patching is not possible, reduce exposure by limiting local shell access, restricting untrusted workloads, tightening container isolation, enabling kernel hardening features, and ensuring unprivileged users cannot load eBPF or other primitives that may assist exploitation. Reboot into the patched kernel after installation; merely installing a kernel package is not sufficient if the running kernel remains vulnerable.

How to confirm the fix worked

Confirm the running kernel, not only the installed package, has been updated. Use uname -r and compare it with the distribution advisory or vendor package changelog for the eventpoll/ep_remove fix. Review package metadata and changelogs for references to CVE-2026-46242, ep_remove, ep_remove_file, eventpoll, or the patch title. On source-built kernels, verify the fix pins the file via epi_fget() at the top of ep_remove() and gates the critical section on successful pinning. After remediation, reboot and re-run uname -r. For exposure validation, identify Linux hosts running affected kernels, especially multi-user servers, container hosts, build runners, shared hosting, desktop fleets with local users, and systems that execute untrusted code.

Typical attack path

1. Gain local code execution as a low-privileged user or inside a workload that can invoke epoll-related syscalls.
2. Create multiple epoll file descriptors and arrange epoll-watches-epoll relationships.
3. Use concurrent threads to race epoll_ctl/close/release activity so ep_remove() overlaps with __fput() and eventpoll_release().
4. Trigger the transient file->f_ep NULL state and force the watched eventpoll or file object to be released while still referenced.
5. Shape kernel heap reuse around kmalloc-192 and file-object allocations to convert the use-after-free into useful memory corruption.
6. Use the corruption to escalate privileges, disable protections, or crash the kernel.

How to detect it

Detecting prior exploitation is difficult because successful kernel memory-corruption exploits may leave few direct artifacts. Start with kernel logs, persistent journal logs, crash dumps, audit logs, EDR telemetry, and authentication records from the period before patching. Look for kernel oops, panic, KASAN, slab, RCU, or general-protection-fault messages mentioning eventpoll, epoll, ep_remove, hlist_del_rcu, ep_eventpoll_release, struct file, or kmalloc-192. Correlate these with local process execution that creates many epoll descriptors, abnormal crashes of user processes, unexpected privilege changes, new root-owned files, new setuid/setcap binaries, modified PAM/sudo/SSH configuration, disabled security agents, or unexplained reboots. In container or CI environments, review workload logs for repeated epoll stress behavior followed by host instability or privilege boundary violations. If crash dumps are available, inspect stack traces for ep_remove(), ep_remove_file(), eventpoll_release_file(), ep_eventpoll_release(), ep_clear_and_put(), hlist_del_rcu(), __fput(), or file_free(). Treat kernel crash evidence plus subsequent suspicious root-level activity as high-confidence compromise requiring incident response.

• BUG: KASAN: use-after-free
• KASAN: use-after-free
• use-after-free in ep_remove
• use-after-free in ep_remove_file
• ep_remove
• ep_remove_file
• eventpoll_release_file
• ep_eventpoll_release
• ep_clear_and_put
• hlist_del_rcu
• __fput
• file_free
• kmalloc-192
• general protection fault
• kernel BUG
• Unable to handle kernel NULL pointer dereference
• RCU detected stall
• slab-use-after-free
• eventpoll: fix ep_remove struct eventpoll / struct file UAF

What your security team should do

• Prioritize patching Linux systems that allow local user access, run containers, host CI/CD jobs, or execute untrusted workloads.
• Track vendor advisories for the exact fixed kernel package and reboot all affected systems into the fixed kernel.
• Hunt for kernel crash logs and KASAN/oops messages referencing eventpoll, ep_remove, ep_remove_file, hlist_del_rcu, ep_eventpoll_release, kmalloc-192, or use-after-free.
• Review recent local privilege-escalation indicators on Linux hosts, including unexpected root shells, new setuid binaries, modified sudoers files, suspicious kernel module activity, and unexplained security-control disablement.
• If patching is delayed, reduce local attack surface by removing unnecessary user accounts, limiting interactive shell access, isolating untrusted workloads, and enforcing container runtime restrictions.
• Monitor threat intelligence for exploit releases or activity associated with the named “Bad Epoll” context and adjust urgency if exploit code becomes available.