A new vulnerability in the Linux kernel is causing concern among system administrators, as it could allow a local unprivileged user privileges their and, under certain conditions, gain root. The issue has been documented as CVE-2026-43502 and is linked to an exploit that researchers at NebuSec have dubbed ZcopyReaper.
The significance of the issue is not limited to the existence of yet another kernel bug. The kernel is the foundation on which the core services of a Linux system operate, and a successful exploitation at this level can give an attacker much broader control than that of a simple user account.
Where is the problem located?
The vulnerability is in the Reliable Datagram Sockets (RDS) zero-copy send path. This technique is designed to transfer data more efficiently by reducing unnecessary copies between user memory and the kernel.
The problem, according to the technical analysis, has been present in the Linux kernel since version 4.17 and later. It occurs when an RDS zero-copy operation fails at a particularly critical point in time: after the user space memory pages have already been committed and "pinned" in memory, but before the corresponding message is connected to the sending socket.
This creates an inconsistency in how the kernel perceives the state of that particular object.
See also: Executing commands in PentestAgent: Critical risk from a distance
A memory management error with serious consequences
ZcopyReaper is essentially related to the lifecycle management of a data structure . The cleanup process is based on the message connection to the socket, while to determine whether it is a zero-copy operation, the presence of the op_mmp_znotifier structure should be checked .
When this distinction is not made correctly, a message that has not yet been placed on the socket queue can be treated as if it contained conventional data pages. The result can be memory corruption in the kernel, creating a basis upon which a local attacker can attempt privilege escalation.
This particular scenario is particularly important because it does not require the attacker to already have advanced privileges on the system.
The exploit was tested in a real environment
NebuSec researchers were able to demonstrate ZcopyReaper on an openSUSE system with kernel 6.4.0-150600.23.100, proving that the issue is not just a theoretical bug.
Furthermore, the attack does not require any special Linux capabilities or the activation of unprivileged user namespaces. This is particularly important for administrators who use disabling user namespaces as a hardening measure. In the case of this specific problem, this measure alone is not sufficient to prevent the attack.
Which systems are exposed?
In order to utilize this code path, the system must have CONFIG_INET and CONFIG_AIO, as well as CONFIG_RDS and CONFIG_RDS_TCP.
See also: Totolink A3002MU: Three new vulnerabilities allow remote attacks
In case RDS support is provided through modules, rds.ko and rds_tcp.ko must be loaded or can be loaded automatically. Therefore, the presence of these modules is another element that administrators should check.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The fix has already been implemented
The upstream fix modifies the rds_message_purge()to store the value of op_mmp_znotifier before the purge process begins.
This way, the kernel can correctly identify whether the message is part of a zero-copy operation. When not yet connected to a socket, the pinned pages tracking is updated and the notifier is released in the correct order, before the payload pages are released.
The change was recorded in commit 44b550d88b26 , with Linux 7.1-rc3 listed as the first mainline release to include the fix. Linux distributions have also begun porting the patch to their supported stable releases.
What should administrators do?
The most basic action is to immediately install the available kernel updates from the manufacturer or Linux distribution being used. After the upgrade, a reboot so that the system is actually running the patched kernel and not the older version.
Where immediate upgrade is not possible, administrators should consider whether RDS and RDS-over-TCP are truly necessary and limit the loading of unnecessary kernel modules.
See also: ConnectWise patches critical ScreenConnect vulnerability – Worm attacks
The ZcopyReaper case is a reminder that kernel issues are particularly serious. A bug that starts as a seemingly fine-grained memory management process can eventually turn into a full-blown privilege escalation mechanism. That's why timely implementation of kernel updates and limiting unnecessary functionality remain among the most important defenses for any Linux infrastructure.
