Critical Linux kernel vulnerability CVE-2026-46242 (Bad Epoll)

CVE-2026-46242 (Bad Epoll)

CVE-2026-46242 (Bad Epoll) is a critical Use-After-Free (UAF) vulnerability in the Linux kernel's epoll subsystem. It allows a local unprivileged user to escalate privileges to root, execute arbitrary code in kernel space, or trigger a denial-of-service (DoS) condition.

Why is this vulnerability dangerous?

If successfully exploited, an attacker can:

• gain root privileges;
• execute arbitrary code in kernel mode;
• fully compromise the affected system;
• trigger a kernel crash and cause denial of service (DoS).

Exploitation requires only local access with a regular user account—no special privileges needed.

Affected systems

This vulnerability affects vulnerable Linux kernel versions containing the epoll subsystem and may be present in various Linux distributions until security updates are installed. Affected distributions include:

• Ubuntu
• Debian
• Rocky Linux
• AlmaLinux
• Fedora
• Red Hat Enterprise Linux (RHEL)

Checking your kernel version

To find out the current kernel version, run the following command on your VPS/DS:

uname -r

Mitigating the vulnerability

Install the latest security updates, including the updated Linux kernel.

Ubuntu / Debian

sudo apt update
sudo apt upgrade

Rocky Linux / AlmaLinux / RHEL

sudo dnf update

For older versions:

sudo yum update

After installing the updated kernel, reboot your server:

sudo reboot

After installing the updates and rebooting, the system will use the new kernel with the latest security patches provided by your distribution's developer.

Verify the system is running the updated kernel. After the reboot, check the kernel version again:

uname -r

The reported version should match the updated kernel.