Linux Kernel: Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges

Linux Kernel Vulnerability "ZcopyReaper" Enables Local Privilege Escalation to Root

Security researchers have uncovered a critical local privilege escalation flaw in the Linux kernel, tracked as CVE-2026-43502 and dubbed "ZcopyReaper." The vulnerability, disclosed by NebuSec researcher Yuan Tan, resides in the Reliable Datagram Sockets (RDS) zerocopy send path, a high-performance networking component. An unprivileged local attacker can exploit this flaw to gain root privileges on affected systems.

The issue affects Linux kernels since version 4.17, exposing a broad range of systems with RDS functionality enabled. The flaw was patched in commit 44b550d88b26, with the fix included in Linux 7.1-rc3 and later releases.

Exploitation Requirements & Impact

To exploit ZcopyReaper, an attacker only needs local access to a vulnerable host no elevated permissions, Linux capabilities, or user namespace support are required. NebuSec demonstrated successful root privilege escalation on an openSUSE system running kernel 6.4.0-150600.23.100.

The vulnerable code path is exposed if the following kernel configurations are enabled:

• CONFIG_INET=y
• CONFIG_AIO=y
• CONFIG_RDS=y or CONFIG_RDS=m
• CONFIG_RDS_TCP=y or CONFIG_RDS_TCP=m

Systems using RDS as loadable kernel modules (rds.ko and rds_tcp.ko) remain at risk if the modules are loaded, even automatically. Notably, disabling unprivileged user namespaces does not mitigate the flaw, as the vulnerability operates independently of CONFIG_USER_NS.

Broader Context & Mitigation

CVE-2026-43502 is part of a larger set of over 20 exploitable Linux kernel vulnerabilities identified by NebuSec’s automated exploit-generation pipeline. Other disclosed flaws include CVE-2026-43501, CVE-2026-43074, CVE-2026-43042, and CVE-2026-31678, among others.

Proof-of-concept exploit material for these vulnerabilities has been published in the CyberMeowfia security research repository. Security teams are advised to prioritize kernel updates, monitor for unexpected RDS module loading, and review local access controls to prevent privilege escalation attacks.

Source: https://gbhackers.com/linux-kernel-zcopyreaper-vulnerability/

Linux Kernel TPRM report: https://www.rankiteo.com/company/linkersec

"id": "lin1789461319",
"linkid": "linkersec",
"type": "Vulnerability",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Systems running Linux kernels '
                                              'since 4.17 with RDS enabled',
                        'industry': 'Technology/Operating Systems',
                        'location': 'Global',
                        'name': 'Linux Kernel',
                        'type': 'Software'},
                       {'customers_affected': 'Users running kernel '
                                              '6.4.0-150600.23.100',
                        'industry': 'Technology',
                        'location': 'Global',
                        'name': 'openSUSE',
                        'type': 'Operating System Distribution'}],
 'attack_vector': 'Local Access',
 'description': 'Security researchers have uncovered a critical local '
                'privilege escalation flaw in the Linux kernel, tracked as '
                "CVE-2026-43502 and dubbed 'ZcopyReaper.' The vulnerability "
                'resides in the Reliable Datagram Sockets (RDS) zerocopy send '
                'path, allowing an unprivileged local attacker to gain root '
                'privileges on affected systems. The flaw affects Linux '
                'kernels since version 4.17 and was patched in Linux 7.1-rc3 '
                'and later releases.',
 'impact': {'operational_impact': 'Root privilege escalation, potential full '
                                  'system compromise',
            'systems_affected': 'Linux systems with RDS functionality enabled '
                                '(kernels since 4.17)'},
 'lessons_learned': 'Automated exploit-generation pipelines can uncover '
                    'critical vulnerabilities; local privilege escalation '
                    'flaws can have severe impacts even without remote access.',
 'post_incident_analysis': {'corrective_actions': 'Kernel patch (commit '
                                                  '44b550d88b26), disabling '
                                                  'RDS if unused, enhanced '
                                                  'monitoring',
                            'root_causes': 'Vulnerability in the RDS zerocopy '
                                           'send path due to improper handling '
                                           'of user-controlled input'},
 'recommendations': ['Prioritize kernel updates to patch CVE-2026-43502 and '
                     'related vulnerabilities',
                     'Disable or restrict RDS functionality if not required',
                     'Monitor for unexpected RDS module loading',
                     'Review local access controls to prevent privilege '
                     'escalation attacks',
                     'Apply patches for other disclosed Linux kernel '
                     'vulnerabilities (e.g., CVE-2026-43501, CVE-2026-43074)'],
 'references': [{'source': 'NebuSec Research',
                 'url': 'https://github.com/CyberMeowfia'}],
 'response': {'containment_measures': 'Kernel updates (patch in commit '
                                      '44b550d88b26, Linux 7.1-rc3+)',
              'enhanced_monitoring': 'Monitor for RDS module loading and '
                                     'privilege escalation attempts',
              'remediation_measures': 'Apply kernel patches, monitor for '
                                      'unexpected RDS module loading, review '
                                      'local access controls'},
 'title': "Linux Kernel Vulnerability 'ZcopyReaper' Enables Local Privilege "
          'Escalation to Root',
 'type': 'Local Privilege Escalation',
 'vulnerability_exploited': 'CVE-2026-43502 (ZcopyReaper)'}