[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAnHI2Z--Cj4MlinKK9q5RULg3xFKTjI0v-sfLaOhm4g":3},{"article":4,"iocs":45,"watch_terms":59,"solutions":60,"lesson":120},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"c8f1ae06-5c58-4bf2-8aeb-c965b2da3887","New \"Bad Epoll\" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android","new-bad-epoll-linux-kernel-flaw-lets-unprivileged-users-gain-root-hits-android-2cc6f7","A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access take full control of a machine as root. It affects Linux desktops, servers, and Android, and a fix is out. Bad Epoll sits in the same small stretch of kernel code where Anthropic's most powerful AI model, Mythos, recently found a different bug. The AI caught one flaw and missed","A critical Linux kernel vulnerability, dubbed 'Bad Epoll' (CVE-2026-46242), has been disclosed, enabling unprivileged users to escalate privileges to root. The flaw, a use-after-free bug, affects Linux desktops, servers, and Android devices. While a fix is available, its exploitability from within Chrome's renderer sandbox and its impact on Android make it particularly concerning.","New 'Bad Epoll' Linux kernel flaw (CVE-2026-46242) allows unprivileged users to gain root access.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fnew-bad-epoll-linux-kernel-flaw-lets.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEggOXDckpE46PYIzBnXsx_kyHzFvlcB3l8qEr6feRNBhRQMKc2p5r2pQArl-NrsoB2z6vE917nXVHpuuMZOgZcRDMlwbVYC0ocK3uIsb-h59qed_kuvDKwvukQCAs-VDcE5Ail8mTRSPpnNfrPzKv5oAMQ9fJCDNE_2PpPrN9a9mOwGUIs0TnWq6_r58HM\u002Fs1600\u002Froot-linux.gif","2026-07-03T19:40:01+00:00","2026-07-03T22:00:20.565982+00:00",9,[17,20,22,25],{"name":18,"type":19},"Mythos","product",{"name":21,"type":19},"Chrome",{"name":23,"type":24},"Linux kernel","technology",{"name":26,"type":24},"Android","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,35,40],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50,53,56],{"type":47,"value":48,"context":49},"cve","CVE-2026-46242","Bad Epoll vulnerability",{"type":47,"value":51,"context":52},"CVE-2026-43074","Previously discovered bug in the same kernel code",{"type":47,"value":54,"context":55},"CVE-2026-31431","Copy Fail vulnerability",{"type":47,"value":57,"context":58},"CVE-2026-31694","FUSE filesystem code vulnerability",[18,21],{"controls":61,"vendors":119},[62,90],{"slug":63,"name":64,"problem":65,"products":66},"patch-management","Automated patch management","Known holes get closed in days, not months.",[67,75,82],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":63,"product_name":79,"url":80,"description":81},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":91,"name":92,"problem":93,"products":94},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[],{"slug":121,"title":122,"body":123,"framework_refs":124,"framework_notes":136},"linux-bad-epoll-kernel-flaw-enables-root-privilege-escalation-on-desktops-servers-and-android","Linux 'Bad Epoll' Kernel Flaw Enables Root Privilege Escalation on Desktops, Servers, and Android","The 'Bad Epoll' vulnerability (CVE-2026-46242) is a use-after-free bug in the Linux kernel that allows unprivileged local users to escalate privileges all the way to root, affecting a massive surface area including Linux servers, desktops, and Android devices. What makes this flaw particularly dangerous is its exploitability from within Chrome's renderer sandbox, meaning a compromised browser process could be leveraged to fully compromise the underlying operating system. This illustrates how layered defenses can be bypassed when foundational components like the kernel contain critical flaws. The widespread deployment of Linux across enterprise infrastructure and the Android ecosystem means delayed patching leaves billions of devices exposed. Organizations that lack rapid kernel patching processes or automated vulnerability tracking will be disproportionately at risk.",[125,126,127,128,129,130,131,132,133,134,135],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST AC-6: Least Privilege","NIST SI-7: Software, Firmware, and Information Integrity","NIST CM-6: Configuration Settings","ITIL: Change Management \u002F Emergency Change Procedures","Android Security Bulletin (Google): Monthly patch cycle compliance","GDPR Article 32: Security of Processing (technical measures to ensure integrity)",{}]