Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more
Researchers disclosed CVE-2026-43502 (ZcopyReaper), a Linux kernel local privilege escalation in the RDS zerocopy send path, fixed in v7.1-rc3.
Yuan Tan reported a Linux kernel local privilege escalation in the RDS zerocopy send path, tracked as CVE-2026-43502 and dubbed ZcopyReaper, posted to oss-security. The flaw was introduced in Linux v4.17 and fixed by commit 44b550d88b26, first appearing in mainline v7.1-rc3. The researchers demonstrated local privilege escalation on an openSUSE system running kernel 6.4.0-150600.23.100. The post also references 20 additional Linux kernel LPEs, though CVE ids were not provided in the excerpt.
- CVE-2026-43502 is an LPE in the RDS zerocopy send path
- Introduced in Linux v4.17; fixed by commit 44b550d88b26 in v7.1-rc3
- LPE demonstrated on openSUSE running kernel 6.4.0-150600.23.100
- Reported alongside 20 more Linux kernel local privilege escalations
- CVEs
- CVE-2026-43502
- Vendors
- Linux
- Products
- Linux kernelopenSUSE
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-43502 | Linux kernel: net/rds: handle zerocopy send cleanup before the message is queued | 7.8 | <1% |
From the original article
Posted by Yuan Tan on Sep 07 Hi all, We found a Linux kernel local privilege escalation vulnerability in the RDS zerocopy send path, tracked as CVE-2026-43502. We call the exploit ZcopyReaper. The vulnerability was introduced in Linux v4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.