Do Son 
TL;DR
Security researchers at NebuSec identified a high-severity local privilege escalation flaw in the Linux kernel. The details of the vulnerability and the proof-of-concept exploit code have been publicly disclosed. Unprivileged local users can exploit this ZcopyReaper Linux vulnerability to gain full system control.
- CVE: CVE-2026-43502
- CVSS: 7.8 (High · CVSSv3)
- Product: Linux
- Affected: 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, 4.17
- Impact: net/rds: handle zerocopy send cleanup before the message is queued
- Status: No confirmed exploitation yet
- Patched in: e9aefdc5c53fe9aed108c14e3d155710a1bb14c9, 46662f7dc59475995609bf3e9d27eb36f4acf26f, 1e262db7675e27f42c3f3f47d6011855f4454f24, 21d70744e6d3bbf9293aa1ee6fba7c53ad75275e (+12 more)
- EPSS: 0.1% (30-day)
- Action: Update to e9aefdc5c53fe9aed108c14e3d155710a1bb14c9, 46662f7dc59475995609bf3e9d27eb36f4acf26f, 1e262db7675e27f42c3f3f47d6011855f4454f24, 21d70744e6d3bbf9293aa1ee6fba7c53ad75275e (+12 more) now
Why It Matters
This ZcopyReaper Linux vulnerability carries a CVSS score of 7.8. This high score represents a severe risk to multi-user environments. Because the details of the vulnerability and the proof-of-concept exploit code have been publicly disclosed, attackers have a ready-made blueprint for exploitation. A local attacker requires no special Linux capabilities to execute the attack successfully. Disabling unprivileged user namespaces also fails to mitigate the danger. Currently, no in-the-wild exploitation has been confirmed.
How the Attack Works
The flaw originates in the RDS network protocol subsystem during zerocopy send operations. The message purge path misinterprets the zerocopy state. This logic error allows an unqueued message to undergo cleanup as if it owned standard payload pages. Consequently, an attacker can manipulate the pinned page accounting. The published ZcopyReaper CVE-2026-43502 exploit demonstrates how this memory mismanagement triggers a local privilege escalation.
Today's exploit, ZcopyReaper is for openSUSE, a lifecycle vulnerability in net/rds: CVE-2026-43502.
ZcopyReaper was introduced in Feb 2018 and fixed upstream in May 2026.
Discovered and exploited by the NebuSec security pipeline.
EXP source: https://t.co/1ICNu9KlNR pic.twitter.com/ax7hZHzvSv
— Cyber Meowfia (@cybermeowfia) September 5, 2026
Affected Versions
The ZcopyReaper flaw entered the Linux kernel in February 2018 with version 4.17. It affects systems where the RDS modules are loaded or available for automatic loading. Researchers successfully demonstrated the attack on an openSUSE system running kernel 6.4.0-150600.23.100.
Patch or Mitigation Steps
Linux maintainers resolved the issue in May 2026 through commit 44b550d88b26. The first mainline release containing the fix is Linux v7.1-rc3. Administrators should update their kernel packages immediately. Furthermore, server operators should disable the loading of RDS kernel modules if their environment does not require them.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
