ZcopyReaper: Critical Linux Kernel Vulnerability Enables Local Privilege Escalation
Security researchers at NebuSec have disclosed CVE-2026-43502, a high-severity Linux kernel vulnerability dubbed ZcopyReaper that allows unprivileged local attackers to escalate privileges to root-level control. The flaw affects the Reliable Datagram Sockets (RDS) zero-copy send path, stemming from improper memory cleanup when an RDS zero-copy operation fails after user-space pages are pinned but before the message is attached to the sending socket.
The vulnerability arises from a lifetime-management error in the rds_message_purge() function, where cleanup logic incorrectly assumes socket association for messages that have not yet entered the queue. This oversight corrupts kernel memory, creating conditions for privilege escalation. ZcopyReaper has existed since Linux kernel version 4.17 and was demonstrated on an openSUSE system running kernel 6.4.0-150600.23.100, proving its practical exploitability beyond denial-of-service attacks.
Notably, exploitation does not require Linux capabilities or unprivileged user namespaces, rendering common hardening measures such as disabling user namespace creation ineffective. Affected systems must have CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP enabled, either compiled into the kernel or loaded as modules (rds.ko and rds_tcp.ko).
The upstream fix, introduced in commit 44b550d88b26, modifies rds_message_purge() to properly check for the op_mmp_znotifier structure before cleanup, ensuring correct zero-copy ownership handling. The patch was merged into Linux 7.1-rc3 and has been backported to stable distributions, including Ubuntu (kernels 7.0.0-28, 6.8.0-136, 5.15.0-186) and Debian.
NebuSec’s automated exploit pipeline also confirmed the vulnerability’s exploitability and released proof-of-concept code, heightening the urgency for administrators to apply vendor-provided kernel updates. Where immediate patching is not feasible, mitigations include disabling unnecessary RDS modules though disabling user namespaces alone does not prevent exploitation.
Source: https://cybersecuritynews.com/zcopyreaper-linux-kernel-vulnerability/
openSUSE Project cybersecurity rating report: https://www.rankiteo.com/company/opensuse-project
"id": "OPE1789395941",
"linkid": "opensuse-project",
"type": "Vulnerability",
"date": "7/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'All Linux distributions with '
'affected kernel versions (e.g., '
'openSUSE, Ubuntu, Debian)',
'industry': 'Technology/Operating Systems',
'location': 'Global',
'name': 'Linux Kernel',
'type': 'Software'}],
'attack_vector': 'Local',
'description': 'Security researchers at NebuSec have disclosed '
'CVE-2026-43502, a high-severity Linux kernel vulnerability '
'dubbed ZcopyReaper that allows unprivileged local attackers '
'to escalate privileges to root-level control. The flaw '
'affects the Reliable Datagram Sockets (RDS) zero-copy send '
'path, stemming from improper memory cleanup when an RDS '
'zero-copy operation fails after user-space pages are pinned '
'but before the message is attached to the sending socket. The '
'vulnerability arises from a lifetime-management error in the '
'rds_message_purge() function, where cleanup logic incorrectly '
'assumes socket association for messages that have not yet '
'entered the queue. This oversight corrupts kernel memory, '
'creating conditions for privilege escalation.',
'impact': {'operational_impact': 'Potential root-level control compromise',
'systems_affected': 'Linux systems with RDS modules enabled '
'(kernel versions since 4.17)'},
'investigation_status': 'Vulnerability disclosed and patch available',
'lessons_learned': 'Common hardening measures like disabling user namespaces '
'are ineffective against this vulnerability. Proper memory '
'cleanup and lifetime management in kernel modules are '
'critical to prevent privilege escalation flaws.',
'post_incident_analysis': {'corrective_actions': 'Kernel patch (commit '
'44b550d88b26) to properly '
'check for op_mmp_znotifier '
'structure before cleanup',
'root_causes': 'Improper memory cleanup in the RDS '
'zero-copy send path due to a '
'lifetime-management error in '
'rds_message_purge()'},
'recommendations': '1. Apply vendor-provided kernel updates immediately. 2. '
'Disable unnecessary RDS modules if patching is not '
'feasible. 3. Monitor for proof-of-concept exploits and '
'unauthorized privilege escalation attempts.',
'references': [{'source': 'NebuSec Research'},
{'source': 'Linux Kernel Commit 44b550d88b26'}],
'response': {'containment_measures': 'Disabling unnecessary RDS modules where '
'patching is not immediately feasible',
'remediation_measures': 'Apply vendor-provided kernel updates '
'(e.g., Linux 7.1-rc3, Ubuntu kernels '
'7.0.0-28, 6.8.0-136, 5.15.0-186, Debian '
'backports)',
'third_party_assistance': 'NebuSec (security researchers)'},
'title': 'ZcopyReaper: Critical Linux Kernel Vulnerability Enables Local '
'Privilege Escalation',
'type': 'Privilege Escalation',
'vulnerability_exploited': 'CVE-2026-43502 (ZcopyReaper)'}