Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android A newly disclosed Linux kernel flaw called Bad Epoll (CVE-2026-46242) lets an ordinary user with no special access take full control of a machine as root. It affects Linux desktops, servers, and Android, and a fix is out. Bad Epoll sits in the same small stretch of kernel code where Anthropic's most powerful AI model, Mythos, recently found a different bug. The AI caught one flaw and missed Ne…

https://thehackernews.com/2026/07/new-bad-epoll-linux-kernel-flaw-lets.html

sha256:4a53fb2bf787fb53a28745c1aa67e2575273140074e1895cee14c0f7b07043e6

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve7
md50
url0
ipv40
ipv60
sha10
domain0
sha2560
malware_token1
attack_pattern0
threat_actor_token1

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
cve	CVE-2026-31431	Open →
cve	CVE-2026-46817	Open →
cve	CVE-2026-46242	Open →
cve	CVE-2026-55200	Open →
cve	CVE-2026-43074	Open →
cve	CVE-2026-31694	Open →
cve

Malware families

Allowlist token matches only.

Metasploitmalware-family

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

Turla

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports