ZcopyReaper: A Local Privilege Escalation in the Linux Kernel RDS Path
ZcopyReaper: A Local Privilege Escalation in the Linux Kernel RDS Path Kernel local privilege escalation flaws rarely make headlines, because they require an attacker to already have a foothold. They matter anyway, because that foothold is exactly what an intruder needs after the initial access, and a reliable escalation turns a limited shell into full control of the host. CVE-2026-43502, named…
ZcopyReaper: Local Privilege Escalation in Linux Kernel RDS Path
Local privilege escalation vulnerabilities in the Linux kernel are rare, but when they occur, the consequences can be severe. CVE-2026-43502, known as ZcopyReaper, is a critical flaw in the RDS (Reliable Datagram Sockets) zerocopy send path of the Linux kernel. This vulnerability allows a local attacker to gain root privileges.
The RDS protocol is designed for low-latency cluster communication and includes a zerocopy send path that transmits data directly in kernel memory, bypassing user space. This optimization requires the kernel to handle references to user pages, which contains the flaw.
When an attacker can manipulate memory handling during a send operation, it can lead to memory corruption. Since kernel context represents the highest privilege level on the machine, this can result in code execution and ultimately root access.
While local privilege escalation typically requires an attacker to already have a foothold on the system, it is still a significant concern. From an initial foothold, an attacker can steal credentials, disable monitoring, install persistence, and potentially compromise other systems that trust the compromised host. In multi-tenant environments, the impact is even more severe, as one compromised account could provide access to the entire server and all tenant data.
To address the vulnerability, users should apply the kernel update that includes the fix for CVE-2026-43502 through their distribution's normal package channel and reboot the system. If immediate patching is not possible, reducing the attack surface can help. The RDS protocol may not be necessary on most general-purpose servers, so disabling the rds kernel module when unused can remove the vulnerable code path from the running kernel.
After applying the patch, it is crucial to review systems that previously ran the vulnerable kernel for signs of escalation. Look for unexpected root-owned processes, modified cron entries, new SSH authorized keys, and changes to system binaries. However, the reporting of CVE-2026-43502 provides limited technical details and does not confirm exploitation in the wild, so additional investigation may be necessary.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
