A new Linux kernel vulnerability dubbed ZcopyReaper allows an unprivileged local attacker to escalate privileges and potentially gain root-level control.
Tracked as CVE-2026-43502, the flaw was demonstrated through an exploit called ZcopyReaper by security researchers at NebuSec. This vulnerability affects the Reliable Datagram Sockets (RDS) zero-copy send path and has existed in the kernel since Linux version 4.17.
The vulnerability stems from incorrect memory cleanup when an RDS zero-copy send operation fails after user-space pages have been pinned but before the associated message is attached to the sending socket.
The affected purge path determines the cleanup method based on the message’s socket association, although zero-copy ownership should instead be determined by the presence of the op_mmp_znotifier structure.
Consequently, a message that has not yet entered the socket queue can be cleaned up as though it contained ordinary payload pages. This lifetime-management error can corrupt kernel memory and provide the conditions required for local privilege escalation.
ZcopyReaper Linux Kernel Vulnerability
NebuSec successfully demonstrated ZcopyReaper on an openSUSE installation running kernel version 6.4.0-150600.23.100, as detailed in the technical disclosure published in Openwall, showing that the issue has practical security implications beyond denial-of-service.
Exploitation does not require Linux capabilities or access to unprivileged user namespaces. Disabling unprivileged user namespace creation therefore does not block the demonstrated attack, a notable detail for organizations that depend on namespace restrictions as part of their Linux hardening strategy.
A vulnerable system must have CONFIG_INET and CONFIG_AIO enabled, together with CONFIG_RDS and CONFIG_RDS_TCP compiled into the kernel or available as loadable modules.
When RDS support is modular, the rds.ko and rds_tcp.ko modules must already be loaded or accessible through automatic module loading for an attacker to reach the affected code path.
| Vulnerability Parameter | Technical Specification & Mechanism | Operational Impact & Mitigation |
| CVE Identifier / Exploit | CVE-2026-43502 / ZcopyReaper | Local privilege escalation to root-level control |
| Subsystem & Origin | Reliable Datagram Sockets (RDS) zero-copy path | Present since Linux 4.17; affects rds_message_purge() |
| Root Cause | Improper memory cleanup prior to socket attachment | Bypasses op_mmp_znotifier checks, corrupting kernel memory |
| Namespace Independence | Does not require unprivileged user namespaces | Hardening via user namespace restrictions is ineffective |
| Kernel Requirements | CONFIG_INET, CONFIG_AIO, CONFIG_RDS, CONFIG_RDS_TCP | Modular setups require rds.ko and rds_tcp.ko to be loaded |
| Upstream Fix | Commit 44b550d88b26 (mainline Linux 7.1-rc3) | Backported to Ubuntu (7.0.0, 6.8.0, 5.15.0) and Debian branches |
The upstream correction changes rds_message_purge() so it captures op_mmp_znotifier before performing cleanup and uses that notifier to identify zero-copy ownership.
If the message has not reached the socket queue, the corrected code directly adjusts pinned-page accounting and releases the notifier before freeing payload pages, preserving the normal completion path for messages already associated with a socket.
The vulnerability was fixed through upstream commit 44b550d88b26, with Linux 7.1-rc3 identified as the first mainline release containing the correction.
Stable distributions have also begun backporting the patch; Ubuntu lists fixes for supported kernels including 7.0.0-28, 6.8.0-136 and 5.15.0-186, while Debian records corrected packages across several maintained branches.
NebuSec said its automated exploit-generation pipeline also confirmed exploitability and produced public exploits for 20 additional Linux kernel vulnerabilities.
The material is available through the company’s CyberMeowfia security-research repository, increasing the urgency for administrators to review affected environments.
Linux administrators should install vendor-provided kernel updates, reboot systems into the patched kernel, and verify the running version afterward.
Where immediate patching is impossible, defenders should determine whether RDS and RDS-over-TCP are required and prevent unnecessary modules from loading; disabling user namespaces alone is not an effective ZcopyReaper mitigation.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
