Seems like:

https://github.com/J-jaeyoung/bad-epoll

...is the source material. I'm not a kernel guy; I'm not following how this works:

"With that control, the exploit gains an arbitrary read of kernel memory through /proc/self/fdinfo ."