Cybersecurity Threat Advisory: ZcopyReaper Linux Kernel Flaw Gives Local Users Root Access, and Exploit Code Is Public

Threat update

A newly detailed Linux kernel vulnerability, tracked as CVE-2026-43502 and nicknamed ZcopyReaper, allows an unprivileged local user to escalate to full root control by abusing a memory-handling error in the kernel's Reliable Datagram Sockets (RDS) component. The flaw has existed since Linux kernel 4.17, working exploit code has been published, and patched kernels are available from major distributions. Organizations running Linux servers, cloud workloads, or Linux-based appliances should confirm patch status now. 

Technical Detail and Additional Info

What is the threat?

ZcopyReaper is a local privilege escalation flaw in the RDS zero-copy send path of the Linux kernel. It was publicly demonstrated in September 2026 by security researchers at NebuSec, who released proof-of-concept exploit code. The bug is rated High, with a CVSS 3.1 base score of 7.8 as listed by Ubuntu.

In simple terms, the vulnerability works like this:

• Root cause: When an RDS zero-copy send fails after the kernel has pinned a user's memory pages but before the message is attached to the sending socket, the cleanup code incorrectly releases that memory accounting. This creates a use-after-free condition in the kernel.
• Attack requirements: The attacker needs an existing local foothold, such as a low-privileged account, a compromised web application, or a container. No special Linux capabilities are needed.
• Kernel configuration: Exploitation requires the kernel to be built with CONFIG_INET, CONFIG_AIO, CONFIG_RDS, and CONFIG_RDS_TCP, either built in or as loadable modules.
• Affected versions: Linux kernel 4.17 and later. The upstream fix landed in Linux 7.1-rc3 and has been backported to stable kernel trees.
• Not a workaround: Disabling unprivileged user namespaces does not stop this exploit.

Public reporting does not describe attacks in the wild at this time. It also does not tie the flaw to a specific threat actor. 

Why is it noteworthy?

Local privilege escalation flaws are the step that turns a small compromise into a full one. An attacker who lands on a Linux system through a stolen password, a vulnerable web application, or a malicious container can use a flaw like this to become root, disable security tools, and move deeper into the environment. With public exploit code available, the skill needed to do so drops sharply.

This is also not the first RDS problem this year. PinTheft (CVE-2026-43494), disclosed in May 2026, was another RDS flaw that allowed local privilege escalation. Two serious bugs in one rarely used networking feature is a strong argument for turning that feature off wherever it is not needed. 

What is the exposure or risk?

Any organization running Linux systems with the RDS modules present and unpatched is exposed, particularly multi-user servers, shared hosting, cloud virtual machines, container hosts, and development or build systems where untrusted code or many users have local access. Many Linux-based network and storage appliances are also built on affected kernels, and their vendors may be slower to ship fixes.

A successful exploit can give an attacker root access, which enables unauthorized data access, malware installation, persistent backdoors, changes to system configuration, and lateral movement to other systems. Ubuntu 20.04 LTS is listed as still vulnerable in Ubuntu's tracker for standard support, so older, out-of-support systems deserve special attention. 

What are the recommendations?

 LBT Technology Group recommends the following actions:

• Patch and reboot. Install your distribution's updated kernel and restart the system, since a kernel update does not take effect until reboot. For Ubuntu, fixed kernels include 7.0.0-28 (26.04 LTS), 6.8.0-136 (24.04 LTS), and 5.15.0-186 (22.04 LTS). Red Hat, SUSE, and Debian users should follow their vendors' advisories and confirm the fix is present rather than relying on version numbers alone.
• Disable RDS where it is not needed. If you cannot patch immediately, unload the module and block it from loading. On Ubuntu, for example, rmmod rds followed by creating a modprobe file containing alias net-pf-21 off prevents automatic loading. Test before rolling out broadly.
• Check whether RDS is loaded. Run lsmod | grep rds across your Linux systems to see where the module is active.
• Enforce least privilege. Limit local accounts, shell access, and container privileges, since the attacker needs a local foothold first.
• Monitor for privilege escalation. Watch for unexpected root shells, new privileged accounts, unusual kernel or module messages, and changes to startup configuration.
• Test, then deploy. Validate kernel updates in staging before production, and prioritize internet-facing and multi-user systems first.
• Retire unsupported systems. Replace or isolate Linux systems that no longer receive kernel security updates.

References

 For more in-depth information about the recommendations, please visit the following links:

• Baran, Guru. "New ZcopyReaper Linux Kernel Vulnerability Enables Privilege Escalation Attacks." Cyber Security News, September 14, 2026.
• LinuxSecurity.com. "openSUSE RDS Cleanup Bug Allows Local Privilege Escalation CVE-2026-43502."
• Ubuntu Security. "CVE-2026-43502." Last updated September 16, 2026.
• Ubuntu. "PinTheft Linux kernel vulnerability mitigation." May 2026.