---
title: "CVE-2026-43074 — An epoll object could be freed while another thread was still using it"
description: "CVE-2026-43074: a Linux eventpoll object could be freed immediately while an RCU reader still reached it through an epitem, causing a use-after-free. The public Android exploit was validated on a Pixel 10 Pro."
url: https://nebusec.ai/buglist/CVE-2026-43074/
published: 2026-07-15T00:00:00.000Z
---

CVE-2026-43074 · High

# An epoll object could be freed while another thread was still using it

Android / Linux kernel · eventpoll · Published Jul 15, 2026

ep_free · ep_get_upwards_depth_proc

* [CVSS 7.8 · CNA ↗](https://www.cve.org/CVERecord?id=CVE-2026-43074)
* Fixed
* Use-after-free
* Unprivileged

Affects · Linux 6.4 and affected stable branches before their fixes · Pixel 10 Pro · Android 17 build CP2A.260705.006 demo target

[View exploit→](#exploit)

Artifacts · [exploit.md](#exploit) · [patch.diff](#patch)

## Summary

Linux epoll keeps links between watched files and an `eventpoll` object. In this bug, one of those links could remain visible to a concurrent RCU reader after the associated `eventpoll` reached its final reference.

The cleanup path freed the object immediately. A thread performing the epoll loop-depth check could therefore continue through the old link and access memory that no longer belonged to the `eventpoll` object.

## Why it mattered

An ordinary local process can create nested epoll descriptors, close them, and repeatedly drive the race from its own threads. A successful race turns a normal lifetime mismatch into kernel memory corruption.

CyberMeowfia validates the issue as a local privilege escalation on a Pixel 10 Pro running the July 2026 Android 17 build. The repository reports a success rate above 80% on that exact target.

The issue has been fixed. The affected-build description here does not imply that a Pixel or Linux system carrying its vendor’s current security updates remains vulnerable.

## What went wrong

`ep_free()` could call `kfree()` for a `struct eventpoll` while an `epitem` referring to it was still visible under RCU. At the same time, `ep_get_upwards_depth_proc()` could obtain the freed object from that `epitem` and read or update its fields.

The missing RCU grace period was the key lifetime error: removing the final normal reference was not enough to prove that every lockless reader had finished.

## Exploit

Because the vulnerability and its fix are public, the exploit orchestrator is included here for reproducibility. The preview starts at `main()` and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; the remaining C files, assembly, headers, and build instructions stay in the linked CyberMeowfia directory.

Public exploit · patched target

CyberMeowfia snapshot4c1f0aa

[Browse all files](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Ndays/Android-CVE-2026-43074)

Exploit orchestrator and entry point · 236 lines · [Open at main() ↗](https://github.com/NebuSec/CyberMeowfia/blob/4c1f0aaaf1b981e74c47f24d88ebdf6ad51c9586/security-research/Ndays/Android-CVE-2026-43074/src/main.c#L44)

```c
int main(int argc, char **argv)
{
  const size_t carrier_size = blob_size(dumpstate_payload_start,
                dumpstate_payload_end);
  struct utsname uts;
  struct stat challenge_stat;
  struct stat socket_stat;
  struct stat su_stat;
  struct timespec now;
  char fingerprint[PROP_VALUE_MAX] = {0};
  char challenge_token[64];
  char command[1024];
  char warm;
  char *challenge;
  char *initial_context;
```

The selected file is the execution entry point. Build files, headers, leak helpers, and supporting sources remain in the linked CyberMeowfia directory.

## Patch

The upstream fix defers freeing the `eventpoll` object until an RCU grace period has elapsed. That guarantees that readers which already reached the object through an `epitem` finish before its memory can be reused.

Install an Android or Linux kernel update containing the applicable stable backport. Version numbers alone are not a reliable test because vendors commonly backport security fixes without adopting the newest upstream kernel.

Find bugs in your code.

Before anyone else does.

[Book a demo](https://nebusec.ai/book-a-demo/)