https://github.com/J-jaeyoung/bad-epoll
...is the source material. I'm not a kernel guy; I'm not following how this works:
"With that control, the exploit gains an arbitrary read of kernel memory through /proc/self/fdinfo ."