Researchers have disclosed a critical security flaw nicknamed “Bad Epoll” (CVE-2026-46242) in the Linux kernel that powers Android phones, tablets, and many Linux computers. The bug is a memory error that allows an ordinary app — even one with no special permissions — to trick the operating system into giving it complete control over the device. Once exploited, an attacker could silently read your messages, photos, and passwords, or install additional software without your knowledge. Importantly, the vulnerable feature (called epoll) cannot be disabled because it is a standard part of how Linux manages running programs, so a software update is the only fix.
The flaw affects Linux kernel version 6.4 and newer. Some older Android phones — including certain Pixel 8 devices still on kernel 6.1 — are not affected, but most phones released in the past year or two are likely running a vulnerable version. Manufacturers and Linux distributions are actively rolling out patches. Interestingly, the original vulnerability was found by a human researcher while investigating a nearby bug (CVE-2026-43074) that had been discovered by an AI model — a reminder that even AI-assisted security scans can miss related flaws nearby.
How to check if you’re affected
Affected devices include Android phones and tablets running Linux kernel version 6.4 or newer. Since most users don’t know their kernel version, the simplest approach is to check for and install any available system update:
- Open Settings > System > System update (wording varies by brand) and install any pending updates. On Samsung devices, look under Settings > Software update.
- Enable automatic updates so future security patches are applied as soon as they are available.
- If your phone is several years old and no longer receives security updates, consider upgrading to a device that still gets regular patches.