A Linux kernel vulnerability called CVE-2026-46242 — nicknamed Bad Epoll — has a publicly available exploit with a documented 99% success rate and no patch deployed across the majority of enterprise Linux server infrastructure. The upstream kernel fix has existed since April. The problem is that enterprise Linux distributions move slower than the upstream kernel, and most organisations have not yet received vendor-issued backports.
This briefing covers what the vulnerability is, who is exposed, and what actions matter this week.
The Technical Reality in Plain Language
Bad Epoll is a flaw in the Linux kernel’s I/O handling subsystem. It allows any user who can run code on a Linux system — even an ordinary, unprivileged account — to gain full root (administrator) access to that system. The attacker needs nothing special: no administrator credentials, no existing elevated privileges, no special system configuration. If they can log in or execute code at all, they can become root.
A researcher named Jaeyoung Chung discovered the vulnerability, built a working exploit, and submitted it to Google’s kernelCTF security research programme. The exploit is now on GitHub. It works against Linux kernel versions 6.4 and later — which is to say: any Linux system updated to a relatively current kernel in the past two years.
Android devices running kernel version 6.6 or later are also affected, covering primarily flagship hardware from 2024 onward.
Why This Is an Enterprise Priority
This is a local privilege escalation, not a remote code execution vulnerability. The distinction matters for prioritisation. An attacker cannot reach an internet-exposed Linux server and immediately exploit this flaw without first gaining some form of access. What Bad Epoll does is convert any level of initial access into full control.
The scenarios where this creates immediate risk:
Multi-tenant and shared infrastructure. Cloud virtual machines, shared hosting environments, developer platforms, and CI/CD build systems all run multiple workloads or users on the same Linux host. Any user or workload that has obtained initial access to the operating system — whether legitimately or through compromise — can escalate to root.
Post-initial-access escalation. In a typical enterprise intrusion, an attacker achieves initial access through a web application vulnerability, a phishing email, or compromised credentials. They land with limited permissions and then escalate. Bad Epoll gives any attacker who reaches a Linux host in your environment an immediate and reliable path from their initial foothold to full control of that host — from which lateral movement typically follows.
Ransomware affiliate operations. Ransomware affiliates operating against enterprise Linux infrastructure — ESXi hypervisors, backup servers, file servers — routinely need privilege escalation after initial access. The availability of a reliable public exploit makes this easier for a wider pool of technically capable attackers.
There is no confirmed active exploitation of CVE-2026-46242 in the wild as of the date of this briefing, and it has not been added to CISA’s Known Exploited Vulnerabilities catalogue. That window is likely to close. The exploit is public, the technique is reliable, and there is a well-established path from public availability to operational use in ransomware and targeted intrusion campaigns.
Where Organisations Currently Stand
The upstream Linux kernel patch was committed on April 24, 2026. The vulnerability was introduced in a code change from April 2023 and first shipped in kernel version 6.4.
Enterprise distribution status as of the time of writing:
- openSUSE Tumbleweed: Patched (rolling release updated promptly)
- Selected Amazon Linux streams: Patched
- Ubuntu (LTS and non-LTS): Patch in progress, not yet released to most streams
- Red Hat Enterprise Linux and CentOS Stream: Backport under development
- Debian stable: Backport pending
The gap between upstream fix and distribution backport is the risk window. Organisations running RHEL, Ubuntu LTS, or Debian stable on servers with kernel 6.4 or later remain exposed until vendor patches are issued and deployed.
Recommended Actions
This week:
-
Inventory kernel versions across your Linux server estate. Any host running kernel 6.4 or later without a vendor patch for CVE-2026-46242 is affected. The command
uname -ron each host gives the kernel version. For large estates, use configuration management tooling (Ansible, Chef, Puppet, AWS Systems Manager, Azure Update Manager) to enumerate this at scale. -
Apply available patches immediately. For openSUSE Tumbleweed and Amazon Linux streams with patches available, treat this as emergency patching. Normal change management windows are not appropriate for a vulnerability with a public 99%-reliable exploit.
-
Escalate with your distribution vendor. If you’re running Red Hat, Ubuntu, or Debian, open a support ticket or check your vendor’s security advisory channel for CVE-2026-46242 specifically. Request an accelerated backport timeline.
-
Identify your highest-risk hosts. Systems accessible from the internet, multi-tenant environments, CI/CD build infrastructure, and any host where untrusted or semi-trusted code executes should be prioritised for both interim hardening and patching.
Interim hardening where patching is delayed:
Linux Security Modules — SELinux (Red Hat and Amazon Linux) and AppArmor (Ubuntu and Debian) — can constrain individual services and reduce the privilege ceiling an attacker reaches even after exploiting the vulnerability. This is a partial mitigation, not a fix. It reduces blast radius but does not eliminate the risk.
What This Isn’t
Bad Epoll is a serious vulnerability but not a catastrophic one in isolation. It does not give internet attackers a path to directly compromise your Linux servers without first obtaining some form of access. Organisations with strong network perimeter controls, minimal external attack surface, and mature initial-access prevention (MFA on all accounts, phishing-resistant authentication, web application firewalls) have a lower likelihood of a Bad Epoll exploitation pathway reaching their servers before patches are deployed.
The risk is elevated for organisations with higher exposure: large Linux server fleets, cloud-hosted infrastructure with many internet-facing services, environments where untrusted code executes as part of normal operations, and sectors that are active targets for opportunistic ransomware operations.
Summary for Board Reporting
CVE-2026-46242 is a high-severity Linux kernel vulnerability with a public exploit. It converts any level of server access into full system compromise. Most enterprise Linux distributions have not yet shipped the patch. Immediate priorities are: enumerate exposure, apply available patches, pressure vendors for accelerated backport delivery, and apply interim hardening (SELinux/AppArmor) on highest-risk systems while patches are pending. No confirmed active exploitation as of the date of this briefing.