Critical Linux kernel vulnerability ZcopyReaper allows privilege escalation

Smarter MSP disclosed that a critical Linux kernel vulnerability, identified as CVE-2026-43502 and nicknamed ZcopyReaper, poses a significant risk to Linux environments. This flaw allows unprivileged local attackers to escalate their privileges and gain root access on affected systems.

The ZcopyReaper vulnerability resides in the RDS (Reliable Datagram Sockets) zerocopy send path and has been present since Linux kernel version 4.17. Attackers can exploit improper memory handling during the RDS cleanup process to achieve privilege escalation. The availability of a public proof-of-concept exploit significantly lowers the barrier for malicious actors, increasing the likelihood of exploitation.

Linux systems are widely used in critical infrastructure, cloud environments, and enterprise servers, making this a high-priority threat. Organizations running affected kernel versions face risks including unauthorized data access, malware installation, and lateral movement across networks. Recommendations include updating to the latest kernel version, disabling the rds.ko module if not required, enforcing least-privilege access controls, and enhancing monitoring and logging.

Source: Smarter MSP