A newly discovered vulnerability in the Linux kernel, known as ZcopyReaper, has been identified by security researchers at NebuSec. This flaw, tracked as CVE-2026-43502, enables local attackers without privileges to escalate their access rights, potentially gaining root-level control.
Understanding the ZcopyReaper Vulnerability
ZcopyReaper affects the Reliable Datagram Sockets (RDS) zero-copy send path and has been part of the Linux kernel since version 4.17. The issue arises from incorrect memory handling during RDS zero-copy operations. Specifically, it occurs when a send operation fails after user-space pages have been pinned but before the message is linked to a socket.
The cleanup process mistakenly uses socket association to manage memory instead of relying on the op_mmp_znotifier structure, allowing uncorrupted messages to be cleaned improperly. This mismanagement can lead to kernel memory corruption, facilitating local privilege escalation.
Demonstration and Impact
NebuSec demonstrated the ZcopyReaper exploit on an openSUSE system with kernel version 6.4.0-150600.23.100, showing significant security implications. Notably, the exploit can be executed without Linux capabilities or access to unprivileged user namespaces, undermining common hardening techniques that rely on namespace restrictions.
For a system to be vulnerable, certain kernel configurations must be enabled, such as CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP. If RDS support is modular, the respective modules need to be loaded for the exploit to be feasible.
Mitigations and Recommendations
The vulnerability has been addressed in the mainline Linux kernel with commit 44b550d88b26, included in version 7.1-rc3. Several stable distributions like Ubuntu and Debian have begun backporting the fix to their supported kernels. Administrators should apply these updates and reboot their systems into the patched kernel versions.
In scenarios where immediate patching is not feasible, it is crucial to assess whether RDS and RDS-over-TCP are necessary and to prevent unnecessary modules from loading. Relying solely on disabling user namespaces will not effectively mitigate the ZcopyReaper threat.
NebuSec’s automated exploit generation has also identified 20 additional Linux kernel vulnerabilities, emphasizing the need for continuous monitoring and timely updates to safeguard systems.
