A newly disclosed vulnerability in the Linux kernel, dubbed “ZcopyReaper,” allows unauthorized local attackers to elevate privileges to root. Tracked as CVE-2026-43502, this flaw resides in the zero-copy send path of Reliable Datagram Sockets (RDS), and was live in the kernel as far back as version 4.17. Researchers from NebuSec disclosed the issue through a public exploit demonstration.
What Goes Wrong Under the Hood
The issue arises when an RDS zero-copy send operation fails after user-space pages have already been pinned—but before the message has been formally attached to its socket. During cleanup, the code path misidentifies whether the message is associated with a socket and skips over the correct ownership check based on the presence of the op_mmp_znotifier structure. The result: kernel memory corruption due to mishandled payload pages.
Because the vulnerability bypasses the notifier based on socket association rather than the notifier itself, attackers can exploit this lifetime management misstep to corrupt memory and gain privileges without needing advanced capabilities or involving namespaces.
Scope, Conditions & Proof
To trigger this bug, certain kernel options must be enabled, including CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP. If RDS is modular, the respective modules (rds.ko and rds_tcp.ko) must be loaded or loadable for automatic loading.
In testing, the exploit was validated on openSUSE using kernel version 6.4.0-150600.23.100. Demonstrators showed that bypassing privilege restrictions—such as unprivileged user namespace limitations—didn’t prevent exploitation.
Linux maintainers fixed the vulnerability via upstream commit 44b550d88b26, which introduced changes to the function rds_message_purge to properly observe op_mmp_znotifier before performing cleanup. The patch adjusts pinned-page accounting and notifier release in scenarios where the message hasn’t been queued on a socket. The fix first appeared in Linux 7.1-rc3, and has been backported to stable kernels in distributions like Ubuntu (versions 7.0.0-28, 6.8.0-136, 5.15.0-186) and multiple Debian branches.
Mitigation Steps for Administrators
Responsible system operators should immediately install vendor patches and reboot into updated kernels. Verifying the running kernel version post-reboot is essential.
When patching isn’t yet feasible, organizations should check whether RDS and RDS-over-TCP are necessary. If not, disabling or preventing those modules from loading can reduce risk. Disabling unprivileged user namespaces alone won’t stop the exploit.
Additionally, proof-of-concept exploits have been made publicly available via the security researchers’ repositories, heightening the urgency for patching affected systems.
Any critical bug in kernel space that enables root access is a serious threat. ZcopyReaper joins a growing list of vulnerabilities in zero-copy or other complex memory‐management paths where failure in edge-case handling leads to privilege escalation. What makes ZcopyReaper notable is its broad exposure—Linux 4.17 and up—and the fact that existing namespace-based hardening does not provide protection. Organizations relying on RDS should audit their kernel configurations, apply fixes immediately, and remain alert for similar issues in other zero-copy implementations.
