ZcopyReaper (CVE-2026-43502): Linux Kernel RDS Zero-Copy Flaw Enables Root Privilege Escalation, Part of 21-CVE LPE Batch
A lifetime-management flaw in the Linux kernel's RDS zero-copy path (CVE-2026-43502, 'ZcopyReaper') lets unprivileged local attackers corrupt kernel memory and gain root; it was fixed in Linux 7.1-rc3 and backported to Ubuntu and Debian, amid a batch of…
CVE-2026-43502, dubbed ZcopyReaper, is a local privilege escalation vulnerability in the Linux kernel's net/rds (Reliable Datagram Sockets) subsystem, publicly discussed on the oss-security mailing list as part of a batch of roughly 21 kernel LPE CVEs published in the 2026 Q3 window and tracked in the kernel.org security vulnerabilities git repository. According to Cyber Security News, the flaw is a lifetime-management error in rds_message_purge() that mishandles zero-copy sends before socket attachment, corrupting kernel memory and enabling privilege escalation to root without requiring capabilities or unprivileged user namespaces; disabling unprivileged user namespaces does not mitigate it. NebuSec demonstrated the exploit on openSUSE kernel 6.4.0-150600.23.100; vulnerable systems require CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP. The fix landed in mainline commit 44b550d88b26 (first in Linux 7.1-rc3), with backports to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches. Blocking the loading of rds.ko and rds_tcp.ko is an interim mitigation. NebuSec also released public exploits for 20 additional Linux kernel vulnerabilities in its CyberMeowfia repository, consistent with the oss-security thread's count of approximately 21 total LPE issues.
- CVE-2026-43502, dubbed ZcopyReaper, resides in the Linux kernel net/rds (Reliable Datagram Sockets) subsystem
- Root cause: lifetime-management error in rds_message_purge() mishandling zero-copy sends before socket attachment, causing kernel memory corruption
- Local privilege escalation to root requires no capabilities or unprivileged user namespaces; disabling unprivileged user namespaces does not mitigate the flaw
- Exploit demonstrated by NebuSec on openSUSE kernel 6.4.0-150600.23.100
- Vulnerable systems require CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP
- Fixed in mainline commit 44b550d88b26, first appearing in Linux 7.1-rc3
- Backported to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches
- Part of a batch of roughly 21 Linux kernel LPE CVEs published in the 2026 Q3 window, tracked in the kernel.org security vulnerabilities git repository
Coverage timelineoldest first · each row is one article
- · 7d agoRe: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more
oss-security· 45
Linux kernel developers discuss a batch of 21 local privilege escalation CVEs, including ZcopyReaper (CVE-2026-43502) in the RDS networking driver.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-43502 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue. Capture op_mmp_znotifier up front in rds_message_purge() and use it as the cleanup discriminator. If the message is already associated with a socket, keep the existing completion path. Otherwise, drop the pinned page accounting directly and release the notifier before putting the payload pages. This keeps early send failure cleanup consistent with the zerocopy lifetime rules without changing the normal queued completion path. NVD description · AI analysis pending | 7.8 | <1% |
| — |