Đang tải bảng tin…
Lobsters0 Hot0 bình luận7 phút đọc
GitHub - J-jaeyoung/bad-epoll
Bad Epoll (CVE-2026-46242) is a race-condition use-after-free vulnerability in the Linux kernel's epoll subsystem, introduced in kernel v6.4 (2023). An unprivileged process can exploit it to gain root access on Linux desktops, servers, and Android devices. The race window is only ~6 instructions wide, yet the exploit achieves 99% reliability by widening the window with a retry loop. Notably, Anthropic's AI model Mythos found a related race bug in the same epoll code path but missed this one. The exploit chains a UAF write into full kernel memory control via a cross-cache attack, arbitrary kernel read through /proc/self/fdinfo, and a ROP chain for root shell. No workaround exists since epoll is a core kernel feature; the only fix is applying upstream commit a6dc643c6931. Kernels v6.4 through the fix date are affected; v6.1-based kernels are not. An Android exploit for Pixel 10 (kernel v6.6+) is in progress.
Nguồn: https://github.com/J-jaeyoung/bad-epoll. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.
Đề xuất cho bạn
All Things Open46 Hot3 phútAI
What is immutable Linux and should you switch to it?
Hệ điều hành Linux bất biến (Immutable Linux) phân phối OS dưới dạng image phiên bản có …
