This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Linux fixes high-severity "Bad Epoll" vulnerability

Linux fixes a high-severity vulnerability named "Bad Epoll", which affects Linux servers, desktops and the Android operating system [1]. To remediate the vulnerability, it is recommended to merge upstream commit a6dc643c6931 [2] or install a backport for your distribution, if available [1]. All systems with upstream kernel versions from 6.4 up to the fixing commit at [2] are vulnerable; however, because the vulnerable code has also been backported to older systems, it is apparently not currently possible to determine all affected distribution versions, and moreover, routine testing with the public exploit [3] on a low number of CPUs may yield false negative results [4]. Ubuntu has not yet released any fixes, Debian has released a fix for all releases except trixie [5], Red Hat has released a fix for NVIDIA for RHEL 10 and RHEL 10 [6], and AlmaLinux has released patches for AlmaLinux 9 and AlmaLinux 10 [7].

Linux kernel - LPE, DoS (CVE-2026-46242)
CVSS 7.8 (High)

An authenticated local attacker can, through a use-after-free in the epoll I/O subsystem of the Linux kernel, where a race condition causes a collision when monitored items are being closed simultaneously, corrupt kernel memory and subsequently escalate their privileges to root or read kernel memory [1].

The vulnerability is present in product:

  • Linux kernel; >=6.4;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 30. 5. 2026.

By CESNET, z.s.p.o. Táňa Macháčková on 8. 7. 2026.

CESNET, z.s.p.o. Logo