New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation Attacks
ZcopyReaper (CVE-2026-43502) lets unprivileged local attackers reach root on Linux via an RDS zero-copy cleanup flaw dating to kernel 4.17.
CVE-2026-43502 is a lifetime-management error in rds_message_purge() that mishandles zero-copy sends before socket attachment, corrupting kernel memory and enabling local privilege escalation without capabilities or user namespaces. NebuSec demonstrated the exploit on openSUSE kernel 6.4.0-150600.23.100; vulnerable systems need CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP. The fix landed in mainline commit 44b550d88b26 (Linux 7.1-rc3) with backports to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches. NebuSec also released public exploits for 20 additional Linux kernel vulnerabilities in its CyberMeowfia repository.
- Local privilege escalation to root requires no capabilities or unprivileged user namespaces
- Disabling unprivileged user namespaces does not mitigate the flaw
- Fixed in mainline commit 44b550d88b26, first in Linux 7.1-rc3, backported to Ubuntu and Debian
- NebuSec published public exploits for 20 more kernel vulnerabilities
- Blocking rds.ko and rds_tcp.ko loading is an interim mitigation
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-43502 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue. Capture op_mmp_znotifier up front in rds_message_purge() and use it as the cleanup discriminator. If the message is already associated with a socket, keep the existing completion path. Otherwise, drop the pinned page accounting directly and release the notifier before putting the payload pages. This keeps early send failure cleanup consistent with the zerocopy lifetime rules without changing the normal queued completion path. NVD description · AI analysis pending | 7.8 | <1% |
| — |
Full article636 words · extracted from cybersecuritynews.com · click to collapse
A new Linux kernel vulnerability dubbed ZcopyReaper allows an unprivileged local attacker to escalate privileges and potentially gain root-level control.
Tracked as CVE-2026-43502, the flaw was demonstrated through an exploit called ZcopyReaper by security researchers at NebuSec. This vulnerability affects the Reliable Datagram Sockets (RDS) zero-copy send path and has existed in the kernel since Linux version 4.17.
The vulnerability stems from incorrect memory cleanup when an RDS zero-copy send operation fails after user-space pages have been pinned but before the associated message is attached to the sending socket.
The affected purge path determines the cleanup method based on the message’s socket association, although zero-copy ownership should instead be determined by the presence of the op_mmp_znotifier structure.
Consequently, a message that has not yet entered the socket queue can be cleaned up as though it contained ordinary payload pages. This lifetime-management error can corrupt kernel memory and provide the conditions required for local privilege escalation.
ZcopyReaper Linux Kernel Vulnerability
NebuSec successfully demonstrated ZcopyReaper on an openSUSE installation running kernel version 6.4.0-150600.23.100, as detailed in the technical disclosure published in Openwall, showing that the issue has practical security implications beyond denial-of-service.
Exploitation does not require Linux capabilities or access to unprivileged user namespaces. Disabling unprivileged user namespace creation therefore does not block the demonstrated attack, a notable detail for organizations that depend on namespace restrictions as part of their Linux hardening strategy.
A vulnerable system must have CONFIG_INET and CONFIG_AIO enabled, together with CONFIG_RDS and CONFIG_RDS_TCP compiled into the kernel or available as loadable modules.
When RDS support is modular, the rds.ko and rds_tcp.ko modules must already be loaded or accessible through automatic module loading for an attacker to reach the affected code path.
| Vulnerability Parameter | Technical Specification & Mechanism | Operational Impact & Mitigation |
| CVE Identifier / Exploit | CVE-2026-43502 / ZcopyReaper | Local privilege escalation to root-level control |
| Subsystem & Origin | Reliable Datagram Sockets (RDS) zero-copy path | Present since Linux 4.17; affects rds_message_purge() |
| Root Cause | Improper memory cleanup prior to socket attachment | Bypasses op_mmp_znotifier checks, corrupting kernel memory |
| Namespace Independence | Does not require unprivileged user namespaces | Hardening via user namespace restrictions is ineffective |
| Kernel Requirements | CONFIG_INET, CONFIG_AIO, CONFIG_RDS, CONFIG_RDS_TCP | Modular setups require rds.ko and rds_tcp.ko to be loaded |
| Upstream Fix | Commit 44b550d88b26 (mainline Linux 7.1-rc3) | Backported to Ubuntu (7.0.0, 6.8.0, 5.15.0) and Debian branches |
The upstream correction changes rds_message_purge() so it captures op_mmp_znotifier before performing cleanup and uses that notifier to identify zero-copy ownership.
If the message has not reached the socket queue, the corrected code directly adjusts pinned-page accounting and releases the notifier before freeing payload pages, preserving the normal completion path for messages already associated with a socket.
The vulnerability was fixed through upstream commit 44b550d88b26, with Linux 7.1-rc3 identified as the first mainline release containing the correction.
Stable distributions have also begun backporting the patch; Ubuntu lists fixes for supported kernels including 7.0.0-28, 6.8.0-136 and 5.15.0-186, while Debian records corrected packages across several maintained branches.
NebuSec said its automated exploit-generation pipeline also confirmed exploitability and produced public exploits for 20 additional Linux kernel vulnerabilities.
The material is available through the company’s CyberMeowfia security-research repository, increasing the urgency for administrators to review affected environments.
Linux administrators should install vendor-provided kernel updates, reboot systems into the patched kernel, and verify the running version afterward.
Where immediate patching is impossible, defenders should determine whether RDS and RDS-over-TCP are required and prevent unnecessary modules from loading; disabling user namespaces alone is not an effective ZcopyReaper mitigation.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Guru Baranhttps://cybersecuritynews.com
Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/zcopyreaper-linux-kernel-vulnerability/