New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation Attacks
ZcopyReaper (CVE-2026-43502) lets unprivileged local attackers reach root on Linux via an RDS zero-copy cleanup flaw dating to kernel 4.17.
CVE-2026-43502 is a lifetime-management error in rds_message_purge() that mishandles zero-copy sends before socket attachment, corrupting kernel memory and enabling local privilege escalation without capabilities or user namespaces. NebuSec demonstrated the exploit on openSUSE kernel 6.4.0-150600.23.100; vulnerable systems need CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP. The fix landed in mainline commit 44b550d88b26 (Linux 7.1-rc3) with backports to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches. NebuSec also released public exploits for 20 additional Linux kernel vulnerabilities in its CyberMeowfia repository.
- Local privilege escalation to root requires no capabilities or unprivileged user namespaces
- Disabling unprivileged user namespaces does not mitigate the flaw
- Fixed in mainline commit 44b550d88b26, first in Linux 7.1-rc3, backported to Ubuntu and Debian
- NebuSec published public exploits for 20 more kernel vulnerabilities
- Blocking rds.ko and rds_tcp.ko loading is an interim mitigation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-43502 | Linux kernel: net/rds: handle zerocopy send cleanup before the message is queued | 7.8 | <1% |
From the original article
3 min read at cybersecuritynews.com
A new Linux kernel vulnerability dubbed ZcopyReaper allows an unprivileged local attacker to escalate privileges and potentially gain root-level control. Tracked as CVE-2026-43502, the flaw was demonstrated through an exploit called ZcopyReaper by security researchers at NebuSec. This vulnerability affects the Reliable Datagram Sockets (RDS) zero-copy send path and has existed in the kernel since Linux version […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.