ZcopyReaper (CVE-2026-43502) and ~20 More Linux Kernel LPEs Disclosed; Public Exploits Released
A lifetime-management flaw in the Linux kernel's RDS zero-copy path lets unprivileged local users gain root; NebuSec also published exploits for 20 more kernel LPEs, bringing the batch to about 21 CVEs.
The Linux kernel net/rds (Reliable Datagram Sockets) subsystem contains a lifetime-management error, dubbed ZcopyReaper and tracked as CVE-2026-43502, in rds_message_purge() that mishandles zero-copy sends before socket attachment, corrupting kernel memory and enabling local privilege escalation to root without any capabilities or unprivileged user namespaces. The flaw dates back to kernel 4.17 and was demonstrated by NebuSec on openSUSE kernel 6.4.0-150600.23.100; affected systems must have CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP enabled. Disabling unprivileged user namespaces does not mitigate the issue. The fix landed in mainline commit 44b550d88b26, first shipped in Linux 7.1-rc3, with backports to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches; blocking loading of the rds.ko and rds_tcp.ko modules is an interim mitigation. The disclosure is part of a batch of roughly 21 Linux kernel local privilege escalation CVEs published in the 2026 Q3 window and tracked in the kernel.org security vulnerabilities git repository, first surfaced in an oss-security mailing list thread on 2026-09-08 and detailed by Cyber Security News on 2026-09-14. NebuSec released public exploits for 20 additional Linux kernel vulnerabilities in its CyberMeowfia repository. No source reports exploitation in the wild. On oss-security, commenters noted that locking kernel module loading after boot has repeatedly proven an effective mitigation against kernel LPEs.
- CVE-2026-43502 (ZcopyReaper) is a lifetime-management error in rds_message_purge() in the Linux kernel net/rds (Reliable Datagram Sockets) subsystem
- Mishandled zero-copy sends before socket attachment corrupt kernel memory, enabling local privilege escalation to root with no capabilities or unprivileged user namespaces
- Flaw dates to kernel 4.17; NebuSec demonstrated the exploit on openSUSE kernel 6.4.0-150600.23.100
- Vulnerable systems require CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP
- Disabling unprivileged user namespaces does not mitigate the flaw; blocking rds.ko and rds_tcp.ko module loading is an interim mitigation
- Fixed in mainline commit 44b550d88b26, first in Linux 7.1-rc3, with backports to Ubuntu 7.0.0, 6.8.0, and 5.15.0 kernels and multiple Debian branches
- The batch totals about 21 Linux kernel LPE CVEs (ZcopyReaper plus 20 more), tracked in the kernel.org security vulnerabilities git repository
- NebuSec published public exploits for 20 additional Linux kernel vulnerabilities in its CyberMeowfia repository
Coverage timelineoldest first · each row is one article
- · 7d agoRe: Linux kernel LPEs: ZcopyReaper (CVE-2026-43502) and 20 more
oss-security· 45
oss-security thread discusses newly disclosed Linux kernel local privilege escalations, including ZcopyReaper (CVE-2026-43502) and about 20 more flaws.
Vulnerabilities in this storyAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-43502 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue. Capture op_mmp_znotifier up front in rds_message_purge() and use it as the cleanup discriminator. If the message is already associated with a socket, keep the existing completion path. Otherwise, drop the pinned page accounting directly and release the notifier before putting the payload pages. This keeps early send failure cleanup consistent with the zerocopy lifetime rules without changing the normal queued completion path. NVD description · AI analysis pending | 7.8 | <1% |
| — |