CVE-2026-46242 Use-After-Free in Epoll Enables 99% Reliable Root on Android and Linux 6.4+

The flaw stems from concurrent free operations on the same epoll object after a 2023 code change. Two kernel paths release the structure without sufficient synchronization, producing a use-after-free that an attacker widens through repeated triggering and retry logic. Jaeyoung Chung's kernelCTF submission demonstrated 99 percent success without crashes on tested x86 and arm64 systems.

Chung's exploit bypasses the renderer sandbox that blocks most other kernel bugs and reaches Android, unlike many recent Linux LPEs. The same epoll region previously yielded CVE-2026-43074, discovered by Anthropic's Mythos model; Mythos missed the sibling race because the window is too narrow for static analysis and the error evades KASAN once the first bug is patched.

This continues the pattern of epoll-related issues following Bad Binder and Bad IO_uring. Unlike deterministic page-cache flaws such as Copy Fail (CVE-2026-31431) now tracked by CISA, Bad Epoll requires winning a timing race yet remains reliable enough for practical use. No in-wild samples appear on public lists.

Upstream fix a6dc643c6931 must be backported to all 6.4+ distributions; 6.1-based Android kernels including early Pixel 8 devices remain unaffected. Expect distribution updates within 30 days and continued AI-assisted audits of shared kernel subsystems.