PoC Archive PoC Archive
CVE-2026-43074 category: binary CVSS 7.8 (HIGH)
Unverified

Linux Kernel eventpoll Use-After-Free LPE (CVE-2026-43074)

Published: 2026-09-03 • Researcher: Nebula Security (NebuSec / CyberMeowfia)

Target software Linux kernel (eventpoll / epoll)
Affected versions Android kernel 6.6.118 (Pixel 10 Pro blazer CP2A.260705.006)
Status Weaponized
Severity High · CVSS 7.8
CVSS 7.8/10
Severity
High
CVE
CVE-2026-43074
Category
binary
Affected product
Linux kernel (eventpoll / epoll)
Affected versions
Android kernel 6.6.118 (Pixel 10 Pro blazer CP2A.260705.006)
Disclosed
2026-09-03
Patch status
Unverified

Archive entry

intelseclab/poc-archive
On this page

Metadata

FieldValue
Date Added2026-09-03
Author / ResearcherNebula Security (NebuSec / CyberMeowfia)
CVE / AdvisoryCVE-2026-43074
Categorybinary
SeverityHigh
CVSS Score7.8
StatusWeaponized
TagsLPE, Linux kernel, eventpoll, epoll, UAF, RCU, Android, Pixel, N-day, C

Affected Target

FieldValue
Software / SystemLinux kernel (eventpoll / epoll)
Versions AffectedAndroid kernel 6.6.118 (Pixel 10 Pro blazer CP2A.260705.006)
Language / PlatformC, aarch64 assembly, Linux/Android
Authentication RequiredYes (local shell, uid 2000)
Network Access RequiredLocal only

Summary

CVE-2026-43074 is a use-after-free in the Linux eventpoll loop-depth check. An epitem can remain visible to an RCU reader after its associated eventpoll has reached a zero reference count. The eventpoll object is freed immediately by ep_free() while ep_get_upwards_depth_proc() can still obtain and use the freed object through the RCU-protected epitem. Nebula Security weaponized this N-day for Android Pixel 10 Pro with over 80% success rate, escalating from unprivileged shell to root.

Fixed upstream: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=07712db80857d5d09ae08f3df85a708ecfc3b61f

Environment / Lab Setup

Output 
Device:       Pixel 10 Pro / blazer
Build:        google/blazer/blazer:17/CP2A.260705.006/15641320:user/release-keys
Kernel:       Linux 6.6.118-android15-8-g53e6e091166e-ab15266607-4k
Architecture: aarch64

Build

Shell script 
1
2
3

make NDK_ROOT=$HOME/android-ndk-cache/android-ndk-r29
adb push exploit /data/local/tmp/
adb shell /data/local/tmp/exploit

References

Notes

Auto-ingested from https://github.com/NebuSec/CyberMeowfia on 2026-09-03.