Local Linux Kernel Vulnerabilities Lead to Root Compromise
A collection of local Linux vulnerabilities has acquired a second life as weaponized code engineered for total root compromise. NebuSec disclosed a series of critical kernel vulnerabilities and published fully functional exploits, meticulously verified across openSUSE, Debian, RHEL, Ubuntu, Fedora, Arch, and Android.
The Severe Threat of ZcopyReaper
The most exemplary flaw bears the moniker ZcopyReaper, officially designated as CVE-2026-43502. The Linux CNA assigned it a severe CVSS 3.1 score of 7.8. This critical error afflicts RDS and zerocopy processing mechanisms. Upon a transmission failure, the kernel incorrectly liberates pinned memory pages, thereby permitting a local user to weaponize this memory corruption into arbitrary code execution with supreme root privileges.
Crucially, ZcopyReaper demands absolutely no specialized capabilities or user namespaces. It merely requires local access alongside a kernel featuring enabled RDS and RDS_TCP components. NebuSec practically demonstrated this privilege escalation on an openSUSE system running kernel version 6.4. The vulnerable code initially surfaced in Linux 4.17; fortunately, developers integrated the official patch into the mainline 7.1-rc3 branch before backporting it to supported stable lineages.
Expanding the Attack Surface
The remainder of this vulnerability series impacts IPVS, IPv6, network bridges, NFQUEUE, XFRM, SCTP, io_uring, SysV IPC, Open vSwitch, and BATMAN. The underlying architectural failures frequently involve use-after-free conditions, double-free memory corruption, and out-of-bounds buffer access. Historically, analogous defects have empowered exploits like SCTPhantom to secure root privileges and seamlessly escape containerized environments into the host system.
Nevertheless, possessing a functional exploit does not equate to the immediate remote subjugation of any given Linux machine. Several attack chains necessitate local code execution, the presence of a specific kernel module, dedicated network namespaces, or highly idiosyncratic configurations. Consequently, the actual risk heavily depends upon the specific distribution and the operational role of the host. This threat becomes particularly pronounced within containerized infrastructures, where isolated processes might illicitly access supplementary networking capabilities.
Clarifying the Scope of Disclosure
Some confusion persists regarding the precise number of vulnerabilities. While OpenNet detailed 18 root-level local privilege escalations, the original NebuSec disclosure on the OSS-Security mailing list explicitly mentions ZcopyReaper alongside “20 more,” ultimately enumerating 22 distinct CVEs. A portion of this list relates to a broader collection of verified exploits; thus, the figure of 18 represents a secondary summation rather than the exact volume of the comprehensive NebuSec publication.
Fortunately, maintainers have already rectified the majority of these problems within current stable branches, although legacy lineages received these updates unevenly. As of September 11, CVE-2026-43042 remained unpatched across several 5.10 through 6.12 kernels, while CVE-2026-31678 persisted within specific older Ubuntu distributions. The core Linux development team strongly advises administrators to migrate completely to the latest stable kernel releases, rather than attempting to manually backport isolated security patches.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
