CVE-2026-43074: Linux Kernel eventpoll Use-After-Free Gives a Root Shell, PoC Exploit Code Publicly Disclosed

TL;DR

A Linux kernel eventpoll flaw lets a local user climb to root. Tracked as CVE-2026-43074, it scores 7.3 on CVSS. Researchers confirmed a working root shell on a Pixel 10 Pro. The full details and proof-of-concept exploit code are now public.

Why it matters

The eventpoll component sits in the core Linux kernel. That means the bug reaches far beyond one phone. On the tested Pixel, a low-privileged process gained full kernel control. Public exploit code raises the stakes for defenders.

How the attack works

The flaw is a use-after-free in the eventpoll loop-depth check. In certain conditions, ep_free() frees the eventpoll structure too early. Another thread still uses that object at the same time.

An epitem can stay visible to a reader after the parent object hits a zero reference count. The reader then touches freed memory. This Linux kernel eventpoll flaw turns that race into privilege escalation.

The researchers demonstrated a root shell by running a binary twice. They reported a success rate above 80 percent. This report withholds working payloads and steps.

Public disclosure and exploit code

Full technical details and proof-of-concept code sit in a public CVE-2026-43074 research repository. This release makes patching urgent.

Exploitation status

Public proof-of-concept exploit code exists for CVE-2026-43074. However, no in-the-wild exploitation has been confirmed at this time.

Affected versions

The flaw affects Linux kernels before the upstream fix. Researchers confirmed it on a Pixel 10 Pro running Android 17 with kernel 6.6.118, using the July 05 release build.

Patch and mitigation

Upstream fixed the issue by deferring the free until an RCU grace period. Apply the latest kernel and Android security updates as soon as they reach your device.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.