New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android
A newly disclosed Linux kernel flaw lets attackers escalate to root on servers and Android—patch urgency spikes globally.
📍 Aftermath
Canonical released fixes for Ubuntu distributions, though coverage of the issue faded without further updates on broader patching or exploitation attempts. The story quieted without a definitive resolution on its impact beyond initial reports.
Epilogue added 46d ago, after coverage quieted.
How fast it spread
How fast coverage is spreading — measured hourly from article rate × source diversity. How this works →
The story so far
A critical zero-day vulnerability, dubbed **DirtyClone (CVE-2026-43503)** or **Bad Epoll**, has been exposed in the Linux kernel. The flaw exploits a race condition in the **epoll** subsystem, allowing unprivileged users to gain root-level privileges on affected systems. Coverage highlights its severity, with comparisons to past high-impact flaws like DirtyCow, and notes its potential to compromise both Linux servers and Android devices.
Major tech and security outlets—including *The Hacker News*, *SecurityWeek*, and *CyberSecurityNews*—are emphasizing the flaw’s **local privilege escalation** capabilities. Canonical has already released patches for Ubuntu distributions, while other Linux vendors are expected to follow. Organizations using Linux-based infrastructure should verify patch status with their vendors.
Monitoring for exploit attempts in the wild is advised, though no active attacks have been confirmed in current reports.
Synthesized by headlinez.news from the headlines below under a strict no-invention contract. ✓ fact-checked: unsupported claims removed (78% supported) Updated 46d ago.
Sources (8)
- New "Bad Epoll" 0-Day Vulnerability Allows Root Access on Linux Servers and Android Devices CyberSecurityNews · 49d ago
- Fragnesia Korben · 49d ago
- Bad Epoll: Kernel Race Bug Beats AI Auditing, Hits 99% Root Exploit Rate Tech Times · 49d ago
- DirtyClone (CVE-2026-43503): Critical Linux Kernel Vulnerability Enables Local Privilege Escalation to Root on Major Distributions Rescana · 49d ago
- Canonical Confirms Ubuntu Fixes for DirtyClone Linux Kernel Flaw Linuxiac · 49d ago
- Critical Linux pedit COW Bug Gives Hackers Instant Root Access SQ Magazine · 49d ago
- ‘DirtyClone’ Linux Kernel Vulnerability Leads to Root Access SecurityWeek · 49d ago
- New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android The Hacker News · 49d ago
The obvious questions
What is DirtyClone (CVE-2026-43503)?
A critical Linux kernel vulnerability that enables unprivileged users to escalate privileges to root via a race condition in the **epoll** subsystem.
Which systems are at risk?
Linux servers and Android devices running vulnerable kernel versions. Canonical has confirmed Ubuntu fixes are available, but other distributions’ patch status varies.
Has this flaw been exploited in the wild?
Coverage does not yet confirm active exploitation, though patch urgency suggests potential for rapid adoption by attackers.
Topics
Related trends
Study of 281 Free Android VPN Apps Finds Traffic Leaks, Unencrypted Data, and Tracking
A study of 281 free Android VPN apps reveals significant security flaws, including traffic leaks and the exposure of sensitive user data.
High-severity guest VM escape is 1 of 2 Linux vulnerabilities to surface this week
A critical Linux KVM vulnerability is allowing guest virtual machines to escape to host systems on Intel and AMD architecture.
Intel Nova Lake CPUs To Bring Back AVX-512 Support Six Years After The Chipmaker Abandoned It On Client Platforms
Intel's upcoming Nova Lake CPUs are set to reintroduce AVX-512 support for both P-cores and E-cores, according to recent leaks.
New Linux pedit COW Exploit Enables Root Access by Poisoning Cached Binaries
Linux systems face a new stealthy root-access exploit targeting cached binaries—no disk traces left behind.