Linux Kernel ZcopyReaper Vulnerability Lets Local Attackers Gain Root Privileges

Security researchers have disclosed a local privilege escalation vulnerability in the Linux kernel related to the Reliable Datagram Sockets (RDS) zero-copy send path. This vulnerability could let an unprivileged local attacker gain root privileges.

It is tracked as CVE-2026-43502 and is referred to as “ZcopyReaper.” NebuSec researcher Yuan Tan reported the issue in a disclosure posted to the OSS Security mailing list.

The vulnerability affects a code path present since Linux kernel version 4.17, which could expose a wide range of systems that include the affected RDS functionality.

According to the Openwall, the flaw was fixed in commit 44b550d88b26, and Linux version 7.1-rc3 is the first mainline release to include the fix.

Exploitable RDS Zerocopy Path

ZcopyReaper resides in the RDS zerocopy send path, a kernel networking component designed for high-performance data transfers. RDS is primarily used in specialized environments where reliable message delivery and low-overhead communication are essential.

An attacker only requires local access to a vulnerable Linux host and does not need elevated permissions, Linux capabilities, or user namespace support to reach the affected code. NebuSec demonstrated root privilege escalation on an openSUSE system running kernel version 6.4.0-150600.23.100.

The minimum configuration needed to expose the vulnerable path includes:

CONFIG_INET=y

CONFIG_AIO=y

CONFIG_RDS=y or CONFIG_RDS=m

CONFIG_RDS_TCP=y or CONFIG_RDS_TCP=m

Systems using RDS as kernel modules may remain exposed if both `rds.ko` and `rds_tcp.ko` are loaded. The disclosure also warns that automatic module loading can make the vulnerable path accessible, even if administrators have not manually loaded the modules.

A notable aspect of CVE-2026-43502 is its independence from unprivileged user namespaces, which are often restricted as a defensive measure against local kernel exploitation.

“CONFIG_USER_NS is not required,” the researcher stated. “Disabling unprivileged user namespace creation does not mitigate the vulnerability.” This means organizations cannot rely on user-namespace hardening as a compensating control.

Instead, administrators should identify systems that enable RDS and RDS-over-TCP support, assess whether the relevant modules are present or can be loaded automatically, and prioritize installing kernel updates that include the upstream fix.

NebuSec has confirmed that CVE-2026-43502 is one of more than 20 exploitable Linux kernel flaws identified through its automated exploit-generation pipeline.

The researchers have published proof-of-concept exploit material for these vulnerabilities through the CyberMeowfia security research repository.

This broader list includes CVE-2026-43501, CVE-2026-43074, CVE-2026-43042, CVE-2026-31678, CVE-2026-31659, and CVE-2026-23274, among numerous other CVEs assigned to the Linux kernel in 2026.

Because public exploits can lower the barrier to local post-compromise activity, defenders should prioritize patching. Security teams should also monitor for any unexpected RDS module loading, review local access controls, and ensure endpoint monitoring can detect suspicious privilege escalation behavior on Linux servers and workstations.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.