Linux Kernel epoll Use-After-Free Local Privilege Escalation (Bad Epoll)

#!/bin/bash
# check_bad_epoll.sh — CVE-2026-46242 (Bad Epoll) version checker
# Run on target Linux host. No root required.
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
echo "[*] Running kernel: $KERNEL"

# Extract major.minor.patch (strip distro suffixes)
VERSION=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN — could not parse kernel version from: $KERNEL"
  exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

ver_gte() {
  # Returns 0 if $MAJOR.$MINOR.$PATCH >= $1.$2.$3
  local m1=$1 m2=$2 m3=$3
  if (( MAJOR > m1 )); then return 0; fi
  if (( MAJOR == m1 && MINOR > m2 )); then return 0; fi
  if (( MAJOR == m1 && MINOR == m2 && PATCH >= m3 )); then return 0; fi
  return 1
}

ver_lt() {
  ! ver_gte "$1" "$2" "$3"
}

# Kernels < 5.15.209: not affected (vulnerable code not present)
if ver_lt 5 15 209; then
  echo "PATCHED — kernel $VERSION predates vulnerable code (introduced ~5.15.209/6.4)"
  exit 0
fi

# 5.15.209 – 5.15.x: check if >= 5.15.x fixed (not affected per Debian, code not present in 5.10/6.1 base)
# 6.1.175 – 6.1.x: fixed in 6.1.178
if (( MAJOR == 6 && MINOR == 1 )); then
  if (( PATCH >= 175 && PATCH < 178 )); then
    echo "VULNERABLE — kernel $VERSION is in affected 6.1.175-6.1.177 range (fixed in 6.1.178)"
    exit 1
  elif (( PATCH >= 178 )); then
    echo "PATCHED — kernel $VERSION includes fix (6.1.178+)"
    exit 0
  else
    echo "PATCHED — kernel $VERSION predates vulnerable backport in 6.1 branch"
    exit 0
  fi
fi

# 6.2 – 6.3.x: affected, no stable fix (upgrade to 6.6.144+)
if (( MAJOR == 6 && (MINOR == 2 || MINOR == 3) )); then
  echo "VULNERABLE — kernel $VERSION is in affected 6.2-6.3 range (upgrade to 6.6.144+)"
  exit 1
fi

# 6.4 – 6.6.x: fixed in 6.6.144
if (( MAJOR == 6 && MINOR >= 4 && MINOR <= 6 )); then
  if (( MINOR == 6 && PATCH >= 144 )); then
    echo "PATCHED — kernel $VERSION includes fix (6.6.144+)"
    exit 0
  else
    echo "VULNERABLE — kernel $VERSION is in affected range (fixed in 6.6.144)"
    exit 1
  fi
fi

# 6.7 – 6.12.x: fixed in 6.12.95
if (( MAJOR == 6 && MINOR >= 7 && MINOR <= 12 )); then
  if (( MINOR == 12 && PATCH >= 95 )); then
    echo "PATCHED — kernel $VERSION includes fix (6.12.95+)"
    exit 0
  else
    echo "VULNERABLE — kernel $VERSION is in affected range (fixed in 6.12.95)"
    exit 1
  fi
fi

# 6.13 – 6.18.x: fixed in 6.18.33
if (( MAJOR == 6 && MINOR >= 13 )); then
  if (( MINOR == 18 && PATCH >= 33 )); then
    echo "PATCHED — kernel $VERSION includes fix (6.18.33+)"
    exit 0
  elif (( MINOR > 18 )); then
    echo "PATCHED — kernel $VERSION is past affected range"
    exit 0
  else
    echo "VULNERABLE — kernel $VERSION is in affected range (fixed in 6.18.33)"
    exit 1
  fi
fi

# 7.0.x: fixed in 7.0.10
if (( MAJOR == 7 && MINOR == 0 )); then
  if (( PATCH >= 10 )); then
    echo "PATCHED — kernel $VERSION includes fix (7.0.10+)"
    exit 0
  else
    echo "VULNERABLE — kernel $VERSION is in affected 7.0.0-7.0.9 range"
    exit 1
  fi
fi

# 7.1+: fixed
if ver_gte 7 1 0; then
  echo "PATCHED — kernel $VERSION is past all affected ranges"
  exit 0
fi

# 5.15.209 – 5.15.x / 5.16.x edge cases
if (( MAJOR == 5 && MINOR == 15 && PATCH >= 209 )); then
  echo "VULNERABLE — kernel $VERSION may contain backported vulnerable code (verify with distro advisory)"
  exit 1
fi

if (( MAJOR == 5 && MINOR == 16 )); then
  echo "VULNERABLE — kernel $VERSION is in affected 5.16 range"
  exit 1
fi

if (( MAJOR == 6 && MINOR == 0 )); then
  echo "PATCHED — kernel $VERSION predates vulnerable code in 6.x branch"
  exit 0
fi

echo "UNKNOWN — kernel $VERSION not in known affected/fixed ranges; verify manually"
exit 2