Epoll Vulnerability CVE-2026-46242 Missed by Mythos

A critical vulnerability in the Linux kernel’s epoll subsystem, designated CVE-2026-46242 (also known as “Bad Epoll”), has been discovered. This use-after-free flaw is caused by a race condition and allows a non-privileged process to gain root privileges. Android devices are also affected, making it a rare privilege escalation vector on the platform.

The vulnerability was reported and exploited by researcher Jaeyoung Chung as a zero-day submission to Google’s kernelCTF. The bounty for the finding has been set at over $71,337.

What makes this case particularly noteworthy is that Anthropic’s AI agent “Mythos,” which was analyzing the same epoll code area, failed to detect this vulnerability. Although Mythos successfully identified a different race condition bug (CVE-2026-43074), it missed Bad Epoll. The AI managed to find two critical race conditions in approximately 2,500 lines of epoll code, but it overlooked one of them.

Details of the Vulnerability

Bad Epoll is one of two race conditions introduced into the epoll code in a single commit in 2023. It is the bug that Mythos failed to detect. The other issue, CVE-2026-43074, was found by Mythos and later exploited as a 1-day vulnerability in a submission to kernelCTF by an independent researcher.

The race window for Bad Epoll is extremely narrow, spanning just about six instructions. This makes it challenging to trigger under normal conditions. However, Chung expanded the race window and implemented a retry loop that avoids crashing the kernel. As a result, the reliability of the exploit reached 99%.

An important characteristic of this vulnerability is that it is difficult to detect using KASAN (Kernel Address SANitizer). Even after CVE-2026-43074 was patched, the use-after-free issue related to Bad Epoll does not typically trigger KASAN. This lack of signals is thought to be one of the reasons Mythos was unable to confidently report the vulnerability.

Why This Is Serious

The most significant threat posed by Bad Epoll is its ability to root Android devices. According to Chung’s report, out of approximately 130 vulnerabilities exploited in Google kernelCTF to date, only about 10 were viable vectors for rooting Android devices. Bad Epoll is one of these rare cases.

Many Linux privilege escalation bugs, such as Copy Fail and its variants, rely on modules that Android does not load, making them ineffective on the platform. In contrast, epoll is a core kernel feature and cannot be disabled or unloaded. Operating systems, network services, and browsers all depend on epoll, leaving patching as the only viable mitigation strategy.

What exacerbates the severity of this vulnerability is its ability to be triggered from within Chrome’s renderer sandbox. While most kernel vulnerabilities are mitigated by sandboxing, Bad Epoll can bypass this restriction. When chained with a renderer exploit, it could enable kernel code execution. This attack vector represents a substantial real-world threat, as demonstrated by Google Project Zero in their “From Chrome renderer code exec to kernel with MSG_OOB” research.

Why Mythos Missed It

Several factors likely contributed to Mythos overlooking Bad Epoll. First, the race window is exceptionally narrow, spanning only about six instructions. Accurately predicting such precise thread interleaving is challenging even for human code reviewers, let alone an AI system.

Second, the lack of runtime evidence played a role. After CVE-2026-43074 was patched, the use-after-free behavior of Bad Epoll rarely triggered KASAN. Even if Mythos had analyzed this code path in depth, it might not have had sufficient evidence to confidently report the vulnerability.

Nevertheless, the fact that Mythos identified the first bug in the same small epoll code path suggests that the AI analyzed the area with considerable depth. It is worth noting that discovering race condition vulnerabilities in the kernel is notoriously difficult. Therefore, Mythos’ discovery of CVE-2026-43074 is a significant achievement in its own right.

Fix and Countermeasures

The only way to address this vulnerability is to apply a patch to the Linux kernel. Since epoll is a core kernel function, it cannot be disabled by unloading a module. It is unclear from publicly available information whether a patch has already been released, but it is likely that details have been shared with Google kernelCTF participants and relevant security teams.

The affected systems include Linux desktops and servers, as well as all Android devices. Environments using the Chrome browser are particularly at risk, as the vulnerability can be triggered from within the renderer sandbox. It is crucial to apply patches promptly to mitigate the risk.

Editorial Opinion

In the short term, the urgent priority is the rapid deployment of patches. The Android ecosystem is particularly vulnerable due to the delays in updates from device manufacturers and carriers. The demonstration of chained attacks with Chrome’s renderer further underscores the real-world threat posed by this vulnerability, emphasizing the need for comprehensive security measures. Corporate security teams must address not only their Linux servers but also the Android devices and browser environments used by their employees.

From a long-term perspective, this incident highlights the limitations of AI in code review. Even a cutting-edge AI model like Mythos missed one of two critical bugs in a relatively small codebase of about 2,500 lines. While AI proves effective in identifying certain types of race condition vulnerabilities, the role of human security researchers remains indispensable. A collaborative approach between AI and human expertise appears to be the most effective strategy for improving kernel security. As an editorial team, we believe it is essential to revisit the criteria for evaluating AI in vulnerability discovery. While the bugs identified by Mythos are commendable, the ones it misses must also be critically assessed.

References

• Bad Epoll - GitHub Repository — Published on 2026-07-04
• Google kernelCTF — Related Program Information