Linux kernel RDS flaw and 20 more LPEs get public exploits

A local privilege escalation in the Linux kernel's Reliable Datagram Sockets (RDS) zerocopy send path, tracked as CVE-2026-43502 and nicknamed ZcopyReaper, allows an unprivileged user to gain elevated privileges. Yuan Tan reported the bug on the oss-security list; it has been present since Linux 4.17 and was fixed ahead of the 7.1-rc3 mainline release.

The flaw needs no special capabilities and does not depend on user namespaces. Reaching it requires only networking, AIO, and RDS (including the TCP transport) built in or loadable as modules. Tan demonstrated escalation on an openSUSE system running a 6.4 kernel.

Tan also listed twenty additional Linux kernel bugs confirmed exploitable for local privilege escalation, each with a CVE identifier. NebuSec's automatic exploit-generation pipeline produced public proof-of-concept exploits for the full set, including ZcopyReaper. The combination of low prerequisites and ready exploits raises the practical risk for any system that loads RDS, even when other hardening measures such as restricted user namespaces are in place.