Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges
Linux kernel RDS zero-copy flaw CVE-2026-43502 (ZcopyReaper) lets unprivileged local users gain root; fix in 7.1-rc3, public PoC published.
55
CVE-2026-31678
- CVSS 3.1
- 7.8 high
- EPSS
- <1%p1
- Published
- ·
- Modified
Description · NVD
In the Linux kernel, the following vulnerability has been resolved: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run after NETDEV_UNREGISTER already detached the device. Dropping the netdev reference in destroy can race with concurrent readers that still observe vport->dev. Do not release vport->dev in ovs_netdev_tunnel_destroy(). Instead, let vport_netdev_free() drop the reference from the RCU callback, matching the non-tunnel destroy path and avoiding additional synchronization under RTNL.
- Vendors
- linux
- Products
- linux kernel
- Weakness
- CWE-367, CWE-362
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H