CVE-2026-43502 ZcopyReaper: Linux RDS Root Exploit, Affected Kernels and Fix

CVE-2026-43502, dubbed ZcopyReaper by security researchers at NebuSec, is a Linux kernel vulnerability in the RDS zero-copy send path with a public proof-of-concept that demonstrated local privilege escalation to root. The important exposure detail is that the demonstrated path does not require Linux capabilities or unprivileged user namespaces. It does, however, depend on vulnerable kernel code and the relevant RDS networking functionality being present and reachable.

This means the right question for administrators is not simply whether a system reports an upstream Linux version associated with the CVE. Exposure depends on the kernel configuration, RDS and RDS/TCP module availability, and whether the distribution has backported the fix into its own supported package.

CVE-2026-43502 is a local root flaw, not a remote-root vulnerability

The vulnerability is a local privilege-escalation issue. The public ZcopyReaper exploit is launched by an unprivileged local process and abuses a memory-lifetime problem in the Linux RDS zero-copy path. Current CVE data describes the attack vector as local.

TPS found no evidence in the reviewed material that CVE-2026-43502 provides an unauthenticated remote path to root. Headlines or summaries that reduce the issue to a generic remote Linux root vulnerability would therefore overstate the exposure.

ZcopyReaper does not need unprivileged user namespaces

NebuSec’s disclosure states that the demonstrated exploit does not require Linux capabilities and does not depend on CONFIG_USER_NS. That distinction matters because disabling unprivileged user namespace creation is a common hardening measure for some Linux privilege-escalation vulnerabilities, but it does not remove the demonstrated ZcopyReaper path.

Administrators should therefore avoid treating a disabled user-namespace setting as proof that a host is protected from CVE-2026-43502.

Which Linux configuration makes the exploit path reachable?

The research identifies the relevant kernel configuration as including CONFIG_INET, CONFIG_AIO, CONFIG_RDS and CONFIG_RDS_TCP. RDS and RDS/TCP may be compiled directly into the kernel or provided as modules. When modular, the relevant modules need to be loaded or available for automatic loading for the demonstrated path to be reachable.

This creates an important difference between theoretical kernel lineage and practical host exposure. A kernel can contain vulnerable code while a specific deployment may not expose the required RDS functionality in the same way as the research target. Conversely, administrators should not assume that RDS is absent merely because they do not intentionally use it in an application.

Upstream Linux branches already contain fixes

Current Linux CNA data identifies fixed or unaffected points across maintained upstream branches, including 5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30 and 7.0.7, with the fix also present in the 7.1 line.

Those numbers are useful for understanding the upstream fix state, but enterprise Linux distributions frequently backport security patches without adopting the same upstream version number. A RHEL, Ubuntu, SUSE or Debian administrator should therefore use the distribution’s own CVE tracker, security advisory and package state as the controlling remediation evidence.

Current distribution status is not uniform

SUSE currently shows a mixed product state for CVE-2026-43502. The reviewed SUSE tracker lists fixed openSUSE Tumbleweed kernel packages while multiple supported enterprise product/kernel combinations remain marked affected. SUSE’s vendor severity assessment can also differ from the CNA’s CVSS 3.1 score, illustrating why administrators should read the product-specific advisory rather than rely on a single global severity label.

Ubuntu’s current state also varies by release and kernel flavour. Some Ubuntu security-update bundles already include CVE-2026-43502 fixes, while other package lines may remain vulnerable, need evaluation or have a different status. Debian has likewise included the CVE in kernel security-update work, but the installed package still needs to be checked against the appropriate release and security tracker.

TPS did not recover a sufficiently complete current RHEL package matrix during this research pass. RHEL users should therefore treat exact package remediation as unresolved here and verify the current Red Hat advisory or CVE package state directly rather than extrapolating from another distribution.

Public exploit does not mean active exploitation in the wild

ZcopyReaper exploit code is public and demonstrates that CVE-2026-43502 can produce root privilege escalation under the documented conditions. That is materially more important than a theoretical CVE description alone.

However, TPS found no authoritative evidence in the reviewed sources showing active exploitation in the wild. Current CVE enrichment describes the exploitation state as proof-of-concept, and the vulnerability was not identified as a CISA Known Exploited Vulnerability in the reviewed state. Those facts can change and should be rechecked if exploitation reports emerge.

What Linux administrators should check now

What remains unknown

The complete package state across every supported Linux distribution and cloud-provider kernel was not established in this research. TPS also did not find evidence confirming exploitation outside research or proof-of-concept activity. Those points should remain separate from the confirmed facts that a working public exploit exists, the vulnerability can produce local root escalation, and the demonstrated path does not rely on unprivileged user namespaces.

This article should be updated on the same URL if Red Hat or another major distribution changes its package status, CISA adds CVE-2026-43502 to the Known Exploited Vulnerabilities catalog, credible in-the-wild exploitation is confirmed, or researchers materially revise the exploit prerequisites or mitigation guidance.