SECURITY researchers have publicly disclosed a high‑severity local privilege escalation in the Linux kernel, tracked as CVE-2026-43502, arising from the RDS network protocol’s zerocopy send path. The flaw, nicknamed ZcopyReaper, allows an unprivileged local user to achieve full system control by manipulating memory accounting during cleanup of zerocopy messages. The PoC exploit details have been published, and NebuSec disclosed how the memory mismanagement can trigger privilege escalation. The advisory notes a CVSS v3 score of 7.8 (High) and an EPSS of 0.1%.
Affected versions include kernels where the RDS module is present, dating back to February 2018 with version 4.17. The NebuSec demonstrations targeted openSUSE running kernel 6.4.0-150600.23.100. The vulnerability was introduced in 2018 and, according to the report, upstream fixes were implemented in May 2026. Evidence cited includes a published PoC and a demonstration of the issue in the net/rds zerocopy cleanup pathway, which misinterprets the zerocopy state and permits improper cleanup of pinned pages.
At present, the article states there are no confirmed in‑the‑wild exploits, but the PoC provides an exploitable blueprint for local attackers.
Mitigation focuses on updating to patched kernels. Maintainers resolved the issue in May 2026; the first mainline release containing the fix is Linux v7.1-rc3. Administrators are advised to update kernel packages promptly and, if RDS is not required, to disable loading of the RDS kernel modules. The patch set includes multiple commits (for example, 44b550d88b26 and related changes) and affects additional CVEs as part of the updated kernel series.