ZcopyReaper: A Local Privilege Escalation in the Linux Kernel RDS Path

Kernel local privilege escalation flaws rarely make headlines, because they require an attacker to already have a foothold. They matter anyway, because that foothold is exactly what an intruder needs after the initial access, and a reliable escalation turns a limited shell into full control of the host.

CVE-2026-43502, named ZcopyReaper, is a local privilege escalation vulnerability in the Linux kernel affecting the RDS (Reliable Datagram Sockets) zerocopy send path. Public reporting in September 2026 described it as critical and noted that it lets a local attacker gain root privileges.

What the RDS zerocopy path does

RDS is a kernel socket protocol originally built for low-latency cluster communication. Its zerocopy send path lets the kernel transmit data without copying it through user space first, which improves throughput for large transfers. That optimization involves pinning user pages and holding references to memory while the kernel works with it. The vulnerability is reported to be in this area, where the handling of those references during a send operation is where the flaw lives.

When a local user can trigger incorrect memory handling in a kernel path, the usual outcome is memory corruption that can be shaped into code execution in kernel context. Kernel context means the highest privilege level on the machine, so the practical result is root.

Why local privilege escalation still matters

An attacker who lands on a host through a web application, a stolen credential or a phishing payload usually arrives as an unprivileged user. From there, kernel escalation is the step that unlocks credential files, disables monitoring, installs persistence and reaches other systems that trust the host. On multi-tenant systems, the impact is larger: one compromised account can become control over the whole server and the data of every tenant on it.

What to do

Apply the kernel update that contains the fix for CVE-2026-43502 through your distribution's normal package channel, and reboot. Kernel fixes do not take effect until the running kernel is replaced, so a package update without a reboot leaves the host exposed.

If you cannot patch immediately, reducing the attack surface helps. The RDS protocol is not needed on most general-purpose servers. Blocking the rds kernel module from loading where it is unused removes the vulnerable code path from the running kernel. Check whether the module is loaded with lsmod and whether RDS sockets are in use before disabling it, because clustered workloads that rely on RDS will break.

After patching, review hosts that ran the vulnerable kernel for signs of escalation: unexpected root-owned processes, modified cron entries, new SSH authorized keys, and changes to system binaries.

Limitations

The public reporting available at the time of writing describes the flaw as a local privilege escalation in the RDS zerocopy send path and rates it critical, but does not provide a full technical root-cause analysis or a confirmed exploitation-in-the-wild report. The description of the mechanism above is limited to what the reporting supports and does not claim a specific memory-safety primitive. Treat the detection guidance as general post-compromise hygiene rather than a tailored indicator set for this CVE.