35
35
55
35
Rushed Patches Follow Broken Embargo on Linux Kernel Vulnerabilities
60
35
35
47
47
47
55
35
47
47
60
30
35
New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation Attacks
ZcopyReaper (CVE-2026-43502) lets unprivileged local attackers reach root on Linux via an RDS zero-copy cleanup flaw dating to kernel 4.17.
CVE-2026-43502 is a lifetime-management error in rds_message_purge() that mishandles zero-copy sends before socket attachment, corrupting kernel memory and enabling local privilege escalation without capabilities or user namespaces. NebuSec demonstrated the exploit on openSUSE kernel 6.4.0-150600.23.100; vulnerable systems need CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP. The fix landed in mainline commit 44b550d88b26 (Linux 7.1-rc3) with backports to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches. NebuSec also released public exploits for 20 additional Linux kernel vulnerabilities in its CyberMeowfia repository.
62
60
35
$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws
Vercel's $1M sandbox challenge surfaced two Linux kernel networking defects—one leaking host kernel memory, one crashing hosts—with CVEs pending.
Vercel ran a two-week, $1 million sandbox escape challenge (Aug 18–Sep 1) on its Firecracker-based microVM sandbox, receiving 1,285 reports and committing ~$325k in payouts (1 Critical, 7 High, 15 Medium, 49 Low validated so far). No attacker accessed real customer data. The most important filing found two independent Linux kernel networking stack defects—one leaks host kernel memory, the other deterministically crashes the host—with wide implications for cloud providers isolating workloads via the same kernel layer. Fixes are under private review with CVEs pending; Vercel also plans to open-source its agentic report-triage agent built on the Eve framework running Kimi K3.
58
60
55
Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more
Researchers disclosed CVE-2026-43502 (ZcopyReaper), a Linux kernel local privilege escalation in the RDS zerocopy send path, fixed in v7.1-rc3.
Yuan Tan reported a Linux kernel local privilege escalation in the RDS zerocopy send path, tracked as CVE-2026-43502 and dubbed ZcopyReaper, posted to oss-security. The flaw was introduced in Linux v4.17 and fixed by commit 44b550d88b26, first appearing in mainline v7.1-rc3. The researchers demonstrated local privilege escalation on an openSUSE system running kernel 6.4.0-150600.23.100. The post also references 20 additional Linux kernel LPEs, though CVE ids were not provided in the excerpt.
65
35
60
30
47
60
30
35
47
ZDI-26-690: Linux Kernel MCTP Routing Uninitialized Memory Information Disclosure Vulnerability
ZDI discloses Linux Kernel MCTP routing uninitialized memory flaw (CVE-2026-45930) letting high-privileged local attackers leak sensitive kernel information.
ZDI-26-690 describes an uninitialized memory information disclosure vulnerability in the Linux Kernel MCTP routing subsystem, tracked as CVE-2026-45930 with a CVSS rating of 6.0. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.
18
ZDI-26-702: Linux Kernel usbnet Driver Race Condition Privilege Escalation Vulnerability
ZDI discloses Linux Kernel usbnet driver race condition (CVE-2025-22050) enabling physically present attackers to escalate privileges without authentication.
ZDI-26-702 covers a race condition privilege escalation vulnerability in the Linux Kernel usbnet driver, assigned CVE-2025-22050 with a CVSS rating of 7.1. A physically present attacker can escalate privileges on affected installations. Authentication is not required to exploit the vulnerability.
30
ZDI-26-688: Linux Kernel OpenvSwitch Race Condition Local Privilege Escalation Vulnerability
ZDI discloses Linux Kernel Open vSwitch race condition (CVE-2026-74465) allowing low-privileged local attackers to escalate privileges, CVSS 7.8.
ZDI-26-688 describes a race condition local privilege escalation vulnerability in the Linux Kernel's Open vSwitch implementation, tracked as CVE-2026-74465 with a CVSS rating of 7.8. An attacker must first obtain the ability to execute low-privileged code on the target system. Successful exploitation grants elevated privileges on affected installations.
45
ZDI-26-689: Linux Kernel SCTP Subsystem Race Condition Information Disclosure Vulnerability
ZDI discloses Linux Kernel SCTP subsystem race condition (CVE-2026-46227) allowing low-privileged local attackers to disclose sensitive information, CVSS 6.4.
ZDI-26-689 describes a race condition information disclosure vulnerability in the Linux Kernel SCTP subsystem, assigned CVE-2026-46227 with a CVSS rating of 6.4. An attacker needs the ability to execute low-privileged code on the target system to exploit the flaw. The vulnerability exposes sensitive information from affected installations.
25
35
35
60
ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability
ZDI-26-695: Linux Kernel NFSv4 server race condition (CVE-2026-89688, CVSS 8.5) enables remote code execution on nfsd systems with authentication.
ZDI advisory ZDI-26-695 describes a race condition in the Linux Kernel NFSv4 server tracked as CVE-2026-89688 with a CVSS score of 8.5. Remote attackers can execute arbitrary code, but authentication is required and only systems with nfsd enabled are vulnerable. No in-the-wild exploitation is mentioned in the advisory.
38