Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges
Linux kernel RDS zero-copy flaw CVE-2026-43502 (ZcopyReaper) lets unprivileged local users gain root; fix in 7.1-rc3, public PoC published.
CVE-2026-43502, dubbed ZcopyReaper, is a Linux kernel local privilege escalation flaw in the RDS zerocopy send path, present since kernel 4.17, allowing unprivileged local attackers to gain root. NebuSec researcher Yuan Tan demonstrated root escalation on openSUSE kernel 6.4.0-150600.23.100; the fix landed in commit 44b550d88b26 with Linux 7.1-rc3 the first patched mainline release. Exploitation requires CONFIG_RDS and CONFIG_RDS_TCP but not unprivileged user namespaces, and PoC exploit material is publicly released alongside more than 20 other exploitable 2026 kernel CVEs.
- Root escalation demonstrated on openSUSE kernel 6.4.0-150600.23.100
- Fixed in commit 44b550d88b26; first fixed release is Linux 7.1-rc3
- Requires CONFIG_RDS/CONFIG_RDS_TCP; disabling user namespaces does not mitigate
- PoC published among 20+ exploitable kernel flaws from automated exploit generation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-23274 | Linux kernel: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels IDLETIMER revision 0 rules reuse existing… | 7.8 | <1% | ||
| CVE-2026-31659 | Linux kernel: batman-adv: reject oversized global TT response buffers batadv_tt_prepare_tvlv_global_data() builds the… | 9.8 | <1% | ||
| CVE-2026-31678 | Linux kernel: openvswitch: defer tunnel netdev_put to RCU release ovs_netdev_tunnel_destroy() may run after… | 7.8 | <1% | ||
| CVE-2026-43042 | Linux kernel: mpls: add seqcount to protect the platform_label{,s} pair | 7.1 | <1% | ||
| CVE-2026-43074 | Linux kernel: eventpoll: defer struct eventpoll free to RCU grace period | 7.8 | <1% | ||
CVE-2026-43501+1 related CVE | Linux kernel: ipv6: rpl: reserve mac_len headroom when recompressed SRH grows ipv6_rpl_srh_rcv() decompresses an RFC 6554… | 9.8 group max | <1% |
From the original article
2 min read at gbhackers.com
Security researchers have disclosed a local privilege escalation vulnerability in the Linux kernel related to the Reliable Datagram Sockets (RDS) zero-copy send path. This vulnerability could let an unprivileged local attacker gain root privileges. It is tracked as CVE-2026-43502 and is referred to as “ZcopyReaper.”
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.