An epoll object could be freed while another thread was still using it

Summary

Linux epoll keeps links between watched files and an eventpoll object. In this bug, one of those links could remain visible to a concurrent RCU reader after the associated eventpoll reached its final reference.

The cleanup path freed the object immediately. A thread performing the epoll loop-depth check could therefore continue through the old link and access memory that no longer belonged to the eventpoll object.

Why it mattered

An ordinary local process can create nested epoll descriptors, close them, and repeatedly drive the race from its own threads. A successful race turns a normal lifetime mismatch into kernel memory corruption.

CyberMeowfia validates the issue as a local privilege escalation on a Pixel 10 Pro running the July 2026 Android 17 build. The repository reports a success rate above 80% on that exact target.

The issue has been fixed. The affected-build description here does not imply that a Pixel or Linux system carrying its vendor’s current security updates remains vulnerable.

What went wrong

ep_free() could call kfree() for a struct eventpoll while an epitem referring to it was still visible under RCU. At the same time, ep_get_upwards_depth_proc() could obtain the freed object from that epitem and read or update its fields.

The missing RCU grace period was the key lifetime error: removing the final normal reference was not enough to prove that every lockless reader had finished.

Exploit

Because the vulnerability and its fix are public, the exploit orchestrator is included here for reproducibility. The preview starts at main() and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; the remaining C files, assembly, headers, and build instructions stay in the linked CyberMeowfia directory.

44
int main(int argc, char **argv)
45
{
46
  const size_t carrier_size = blob_size(dumpstate_payload_start,
47
                dumpstate_payload_end);
48
  struct utsname uts;
49
  struct stat challenge_stat;
50
  struct stat socket_stat;
51
  struct stat su_stat;
52
  struct timespec now;
53
  char fingerprint[PROP_VALUE_MAX] = {0};
54
  char challenge_token[64];
55
  char command[1024];
56
  char warm;
57
  char *challenge;
58
  char *initial_context;

Patch

The upstream fix defers freeing the eventpoll object until an RCU grace period has elapsed. That guarantees that readers which already reached the object through an epitem finish before its memory can be reused.

Install an Android or Linux kernel update containing the applicable stable backport. Version numbers alone are not a reliable test because vendors commonly backport security fixes without adopting the newest upstream kernel.