In the Linux kernel

ep_remove() in fs/eventpoll.c mishandles the teardown ordering between a struct eventpoll instance and the backing struct file, leaving a dangling reference that a local process can race and reuse. Because epoll is the default I/O readiness mechanism for essentially every serious Linux daemon (nginx, systemd, containerd, Docker, Node.js, JVM NIO, Envoy), the vulnerable code path is reachable from any unprivileged process that can call epoll_create and epoll_ctl — which is to say, all of them. Affected trees include mainline prior to the 2026-05-30 fix; stable series 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.12.y all required backports, and distro kernels lag by days to weeks.

Vendor CVSS of 7.8 (AV:L/AC:L/PR:L) matches reality for a kernel UAF: local unprivileged attacker, high impact on C/I/A, no user interaction. It is *not* remote and it is *not* wormable, so calling it CRITICAL would be wrong — but downgrading past HIGH ignores the fact that kernel UAFs in ubiquitous subsystems have a long track record of being weaponized into reliable SMEP/SMAP-bypassing LPEs within weeks of disclosure (see CVE-2022-32250, CVE-2022-0847, CVE-2023-3269).

Why this verdict

• Ubiquity of the primitive: epoll is called by essentially every Linux daemon and by unprivileged users with no seccomp restriction on default Docker/Podman profiles — the attack surface is every Linux host in your fleet.
• Role multiplier — Kubernetes worker nodes and CI runners: on a K8s node, any pod-escape or workload with hostPID/hostNetwork gains local execution; LPE via this UAF elevates from pod-uid to node-root, which in a shared cluster means all tenants on that node. Chain ends in cluster compromise — floor is HIGH.
• Role multiplier — bastion / jump hosts and shared dev boxes: any authenticated SSH user becomes root. Blast radius is every account that pivots through that host.
• Role multiplier — container hosts running rootless workloads: the whole security model of rootless containers assumes kernel isolation holds. This UAF invalidates that assumption.
• Friction — local vector only: requires prior code execution. Not internet-reachable, not wormable, no drive-by. This is what keeps the verdict from crossing into CRITICAL.
• Friction — no public PoC at time of assessment: EPSS 0.00123 reflects this, but the historical base rate for eventpoll UAFs going from disclosure to working exploit is short (2–6 weeks).

Why not higher?

Not CRITICAL because there is no remote vector, no unauthenticated pre-auth path, and no in-the-wild exploitation observed. CRITICAL is reserved for kernel bugs with a network reachability story (netfilter remote paths, ksmbd RCEs) or active KEV listing — neither applies here.

Why not lower?

Not MEDIUM because the affected code path is universal (every Linux host, every user), kernel UAFs in this subsystem have a proven weaponization history, and the blast radius on high-value roles (K8s nodes, bastions, CI runners) ends in tenant or cluster compromise. Downgrading to MEDIUM would ignore the role-multiplier floor for multi-tenant Linux.

1. Deploy the vendor kernel patch on multi-tenant and shared-execution hosts first — Prioritize Kubernetes nodes, CI/CD runners, bastion hosts, and shared dev environments — anywhere untrusted local execution is by design. Per noisgate mitigation SLA for HIGH, complete this within 30 days; use live-patching (kpatch, kernelcare, Ubuntu Livepatch) where available to avoid reboot windows.
2. Enforce a seccomp profile that blocks or restricts epoll_ctl on high-risk workloads — For containers that do not legitimately need epoll (batch jobs, sidecars, scanners), block the syscall via a custom seccomp profile in Docker/containerd/Kubernetes PodSecurity. Applies immediately; buys you until the patch rollout completes.
3. Enable and audit CONFIG_RANDOM_KMALLOC_CACHES and CONFIG_INIT_ON_FREE_DEFAULT_ON — These kernel hardening options materially reduce the reliability of slab-reuse exploitation. Available in 6.6+; verify with zcat /proc/config.gz | grep -E 'RANDOM_KMALLOC|INIT_ON_FREE'. Roll into your golden image within the 30-day mitigation window.
4. Tighten kernel.kptr_restrict=2, kernel.dmesg_restrict=1, and kernel.unprivileged_bpf_disabled=1 — Cuts the infoleak primitives that a working exploit needs alongside the UAF. Push via sysctl.d/ansible; effective immediately, no reboot.
5. Increase auditd coverage for post-exploit indicators — Add watches on /etc/modprobe.d, /proc/sys/kernel/core_pattern, and unexpected UID=0 execve from non-root parent PIDs. You cannot catch the race, but you *can* catch the payoff.

Run on each Linux host as any user (root not required to read the kernel version). Invoke as ./check-cve-2026-46242.sh — no arguments. Exits 0 if patched, 1 if vulnerable, 2 if undetermined.

#!/usr/bin/env bash
# noisgate verification for CVE-2026-46242 (eventpoll UAF)
# Checks running kernel version against known-fixed versions per distro.
set -u

KREL=$(uname -r)
DISTRO="unknown"
if [ -r /etc/os-release ]; then
  . /etc/os-release
  DISTRO="${ID:-unknown}"
fi

# Extract numeric kernel version (major.minor.patch)
KVER=$(echo "$KREL" | awk -F'[.-]' '{print $1"."$2"."$3}')

ver_ge() {
  # returns 0 if $1 >= $2 (semver-ish)
  [ "$(printf '%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

result="UNKNOWN"
case "$DISTRO" in
  ubuntu)
    # Ubuntu USN backports typically bump ABI; check the -N.NN suffix
    ABI=$(echo "$KREL" | grep -oE '\-[0-9]+' | head -n1 | tr -d '-')
    # Placeholder: replace with the USN-published fixed ABI once released
    FIXED_ABI_MIN=1099
    if [ -n "$ABI" ] && [ "$ABI" -ge "$FIXED_ABI_MIN" ] 2>/dev/null; then
      result="PATCHED"
    else
      result="VULNERABLE"
    fi
    ;;
  rhel|centos|rocky|almalinux)
    # RHEL uses kernel-5.14.0-<build>.el9; consult RHSA for fixed build number
    BUILD=$(echo "$KREL" | grep -oE '\-[0-9]+\.[0-9]+' | head -n1 | tr -d '-' | awk -F. '{print $1}')
    FIXED_BUILD_MIN=600  # replace with RHSA-published value
    if [ -n "$BUILD" ] && [ "$BUILD" -ge "$FIXED_BUILD_MIN" ] 2>/dev/null; then
      result="PATCHED"
    else
      result="VULNERABLE"
    fi
    ;;
  debian)
    # Debian: check package version via dpkg
    if command -v dpkg >/dev/null 2>&1; then
      PKGV=$(dpkg-query -W -f='${Version}' "linux-image-$KREL" 2>/dev/null)
      # Replace 6.1.99-1 / 6.12.20-1 with DSA-published fixed versions
      if echo "$PKGV" | grep -qE '6\.(1\.9[9-9]|12\.[2-9][0-9])'; then
        result="PATCHED"
      else
        result="VULNERABLE"
      fi
    fi
    ;;
  *)
    # Upstream / other: fix landed after v6.14; anything >= 6.15 is patched
    if ver_ge "$KVER" "6.15.0"; then
      result="PATCHED"
    elif ver_ge "$KVER" "5.10.0"; then
      result="VULNERABLE"
    fi
    ;;
esac

echo "CVE-2026-46242 status on $(hostname): $result (kernel=$KREL, distro=$DISTRO)"
case "$result" in
  PATCHED)    exit 0 ;;
  VULNERABLE) exit 1 ;;
  *)          exit 2 ;;
esac

Sources

1. NVD entry for CVE-2026-46242
2. kernel.org linux-cve-announce archive
3. CISA Known Exploited Vulnerabilities catalog
4. FIRST EPSS lookup
5. Ubuntu CVE tracker
6. Red Hat CVE portal
7. Debian security tracker
8. kernelCTF rules and past eventpoll writeups