🚨 CVE-2026-46242 - BadEpoll

A high-severity Use-After-Free vulnerability affecting the Linux Kernel eventpoll subsystem that may allow local privilege escalation, memory corruption, or denial of service.

---

📖 Overview

CVE-2026-46242 is a Use-After-Free (UAF) vulnerability in the Linux Kernel's eventpoll (epoll) implementation.

The issue exists inside the ep_remove() logic where a race condition allows a struct file and its associated eventpoll object to be freed while they are still being referenced.

An attacker with local access can exploit this race condition to corrupt kernel memory, potentially leading to:

• 🔺 Local Privilege Escalation
• 💥 Kernel Memory Corruption
• 🚫 Denial of Service (Kernel Panic)
• ⚠️ System Instability

📊 Vulnerability Details

🧠 Root Cause

The vulnerability occurs because:

1. ep_remove() clears file->f_ep.
2. Another thread can simultaneously execute __fput().
3. The associated eventpoll object may be released.
4. Execution continues using pointers that now reference freed memory.
5. Subsequent writes trigger a classic Use-After-Free condition.

The upstream fix pins the struct file using epi_fget() before entering the critical section, preventing concurrent release while cleanup is performed. :contentReference[oaicite:0]{index=0}

🎯 Impact

Successful exploitation could allow an attacker to:

• Escalate privileges to kernel level
• Corrupt kernel memory
• Crash the operating system
• Trigger arbitrary kernel behavior

Although the vulnerability is local-only, it represents a significant security risk on multi-user systems.

📦 Affected Versions

✅ Fixed Versions

• 6.18.33
• 7.0.10
• 7.1-rc1 and later

🔬 Technical Summary

ep_remove()
      │
      ▼
Clears file->f_ep
      │
      ▼
Concurrent __fput()
      │
      ▼
eventpoll object freed
      │
      ▼
ep_remove() continues
      │
      ▼
Dereference freed memory
      │
      ▼
Use-After-Free

📸 Demo

⚠️ Exploitation

Current public status:

🛡️ Mitigation

• Upgrade to a patched Linux kernel.
• Apply stable kernel security updates.
• Restrict local untrusted user access until updates are installed.
• Monitor vendor advisories for distribution-specific backports.

🔍 Detection

Check your current kernel:

uname -r

Example:

6.18.12

Compare the installed version against the patched releases.

💻 References

• CVE Record
• NVD
• Linux Kernel Stable Git Repository

📚 Timeline

⚖️ CVSS v3.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

📄 License

This repository is provided for educational, research, and defensive cybersecurity purposes only.

It does not contain exploit code or offensive tooling.