New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation Attacks
A critical vulnerability in the Linux kernel, CVE-2026-43502 (ZcopyReaper), allows unprivileged local attackers to escalate privileges to root by exploiting improper memory cleanup in the RDS zero-copy send path.
A newly identified vulnerability in the Linux kernel, dubbed ZcopyReaper and tracked as CVE-2026-43502, presents a significant risk of privilege escalation for local attackers. Security researchers at NebuSec demonstrated an exploit for this flaw, showcasing its potential to grant root-level control to unprivileged users. The vulnerability resides within the Reliable Datagram Sockets (RDS) zero-copy send path, a component that has been present in the kernel since version 4.17.
The root cause of ZcopyReaper lies in an error in memory cleanup procedures. Specifically, when an RDS zero-copy send operation fails after user-space pages have been pinned, but before the associated message is fully attached to the sending socket, the kernel's cleanup path can become corrupted. The affected purge path incorrectly determines the cleanup method based on the message's socket association, rather than properly checking for the presence of the op_mmp_znotifier structure, which is the correct indicator of zero-copy ownership. This misjudgment leads to a situation where a message not yet queued to the socket can be purged as if it were ordinary payload data, corrupting kernel memory and creating an opening for privilege escalation.
NebuSec's proof-of-concept exploit, ZcopyReaper, was successfully demonstrated on an openSUSE system running kernel version 6.4.0-150600.23.100. This practical demonstration highlights that the vulnerability is not merely theoretical but has tangible security implications, extending beyond simple denial-of-service scenarios. A critical aspect of this vulnerability is that its exploitation does not require elevated Linux capabilities or access to unprivileged user namespaces. This means that common hardening techniques, such as disabling unprivileged user namespace creation, will not prevent an attacker from leveraging ZcopyReaper, posing a challenge for organizations relying on these measures for defense.
For an attack to be successful, certain kernel configurations must be enabled. Specifically, the system must have CONFIG_INET and CONFIG_AIO enabled. Additionally, CONFIG_RDS and CONFIG_RDS_TCP must be compiled into the kernel or available as loadable modules. In environments where RDS support is modular, the rds.ko and rds_tcp.ko modules must be loaded or capable of being automatically loaded for the vulnerable code path to be reachable by an attacker.
The fix for CVE-2026-43502 was implemented in the mainline Linux kernel through commit 44b550d88b26, appearing in Linux 7.1-rc3. This upstream correction modifies the rds_message_purge() function to correctly identify zero-copy ownership by checking the op_mmp_znotifier structure before proceeding with cleanup. If the message has not yet been associated with a socket, the corrected code accurately adjusts pinned-page accounting and releases the notifier before freeing payload pages, ensuring the normal completion path for socket-associated messages is preserved.
Stable Linux distributions have also begun backporting the necessary patches. Ubuntu has released fixes for its supported kernels, including versions 7.0.0-28, 6.8.0-136, and 5.15.0-186. Debian has also incorporated the correction into several of its maintained branches. Administrators are strongly advised to apply these vendor-provided kernel updates promptly and reboot their systems to ensure the patched kernel is active.
In situations where immediate patching is not feasible, administrators should assess their reliance on RDS and RDS-over-TCP. Disabling unnecessary modules related to these services can serve as a temporary mitigation. However, it is crucial to reiterate that disabling user namespaces alone is insufficient to protect against ZcopyReaper exploitation. The researchers also noted that their automated exploit-generation pipeline confirmed exploitability for 20 additional Linux kernel vulnerabilities, underscoring the ongoing need for vigilance and timely patching.
The ZcopyReaper vulnerability highlights a persistent challenge in kernel security: managing the lifecycle of memory resources, especially in complex features like zero-copy networking. The bypass of user namespace restrictions is particularly concerning, as it negates a common defense-in-depth strategy. Organizations must prioritize patching and maintain robust security practices to defend against such sophisticated privilege escalation attacks.