Loading story…
CVE-2026-43502 (ZcopyReaper) is a Linux kernel local privilege-escalation flaw in the Reliable Datagram Sockets (RDS) zero-copy send cleanup path. A lifetime-management/use-after-free condition can occur after a failed zero-copy send pins application pages before associating them with a socket queue, allowing an unprivileged local user to obtain root privileges. NebuSec publicly demonstrated the issue on openSUSE kernel 6.4.0-150600.23.100; the reported exploit does not require Linux capabilities or user namespaces, so disabling user namespaces does not mitigate the demonstrated path.
The vulnerability was introduced in Linux v4.17 and fixed upstream by commit 44b550d88b26, first appearing in Linux v7.1-rc3, with fixes reportedly propagated to stable kernel trees. NebuSec released a public ZcopyReaper exploit and said its automated exploit-generation pipeline also produced exploits for 20 additional kernel flaws. No in-the-wild exploitation has been reported. Organizations should deploy vendor kernel updates and determine whether RDS or RDS-over-TCP support is built in, loaded, or can be autoloaded on affected hosts.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
NebuSec published public code for the ZcopyReaper local privilege-escalation exploit for CVE-2026-43502 on September 8, 2026.
NebuSec stated that its automated exploit-generation pipeline had identified and exploited CVE-2026-43502 and 20 additional Linux kernel vulnerabilities, and that exploit material was published in its CyberMeowfia GitHub repository.
On September 7, 2026, NebuSec's Yuan Tan reported CVE-2026-43502, dubbed ZcopyReaper, to the oss-security mailing list. The report described local root escalation by an unprivileged user and a demonstration against openSUSE kernel 6.4.0-150600.23.100.
Ubuntu reported fixes for CVE-2026-43502 in supported kernel versions including 7.0.0-28, 6.8.0-136, and 5.15.0-186. Debian also recorded corrected packages across multiple maintained branches.
Linux kernel commit 44b550d88b26 fixed CVE-2026-43502; Linux 7.1-rc3 was identified as the first mainline release containing the fix. A subsequent public follow-up said the fix had been applied across stable kernel trees.
The RDS zero-copy send cleanup flaw later designated CVE-2026-43502 was reported as having been introduced in Linux kernel version 4.17.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcelinuxsecurity.com
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026
`CVE-2026-31431` is a Linux kernel flaw classified as **CWE-669: Incorrect Resource Transfer Between Spheres** that can enable local privilege escalation to root and, in some cases, bypass isolation boundaries. The Canadian Centre for Cyber Security warned that the impact becomes more severe when the bug is chained with a remote code execution vulnerability, and urged organizations to identify exposed systems, apply vendor fixes, reboot after kernel updates, restrict access, enforce kernel security controls, monitor logs, and segment high-risk or Internet-facing workloads. Vendor and community activity indicates broad exposure across modern Linux platforms. Red Hat lists **RHEL 8**, **RHEL 9**, **RHEL 10**, and corresponding `kernel-rt` packages as affected, while **RHEL 6** and **RHEL 7** are marked not affected because the vulnerable code is absent. Public exploit interest accelerated after Theori published the **"Copy Fail"** technical write-up and proof-of-concept repository, which references testing on **Ubuntu 24.04 LTS**, **Amazon Linux 2023**, **RHEL 10.1**, and **SUSE 16**; Rocky Linux also published related errata, signaling downstream patch availability in enterprise Linux ecosystems.
Jun 29, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 23, 2026