In the Linux kernel

CVE-2026-43502 is a use-after-free in the Linux kernel's net/rds (Reliable Datagram Sockets) subsystem. When a zerocopy send fails after user pages have been pinned but *before* the message is attached to the sending socket, the purge path misidentifies the page ownership. It cleans up pinned zerocopy pages as if they were normal payload pages, freeing memory the kernel still references. An unprivileged local user can trigger this race to corrupt kernel memory and escalate to root. The bug was introduced in Linux 4.17 (February 2018) and affects every kernel up through pre-7.1-rc3 — an eight-year window. Fixed versions include mainline 7.1-rc3, Ubuntu 6.8.0-136.136 (noble), 5.15.0-186.196 (jammy), and 7.0.0-28.28 (plucky).

The vendor score of HIGH / 7.8 is accurate and needs no adjustment. The attack is local-only (AV:L) which caps remote risk, but three factors keep it firmly HIGH: (1) a polished public PoC ('ZcopyReaper' by NebuSec) removes the exploit-development barrier, (2) the RDS kernel module can be auto-loaded by an unprivileged user via socket(AF_RDS, ...) on default configurations of many distros unless kernel.modules_disabled or module blocklisting is in effect, and (3) the affected version range spans virtually every production kernel shipped in the last eight years. The vendor got this one right.

Why this verdict

• Public PoC removes exploit barrier: The ZcopyReaper PoC from NebuSec is published and demonstrated on a current enterprise kernel. This shifts the threat from theoretical to script-kiddie accessible for anyone with local access.
• RDS auto-load broadens the target surface: On default RHEL, Ubuntu, SUSE, and Debian installs, an unprivileged user can call socket(AF_RDS, ...) to auto-load rds.ko, making the vulnerable code reachable even on hosts that never intentionally use RDS. This neutralizes the 'niche module' downgrade argument.
• Eight-year affected range: Kernels from 4.17 (2018) to 7.1-rc3 (2026) are vulnerable. In a 10,000-host fleet, the vast majority of Linux hosts will be running a kernel in this range until patched.
• Role multiplier: This is a *kernel* vulnerability. On hypervisor hosts (KVM), root compromise means control of all guest VMs — blast radius is fleet-scale. On container orchestration nodes (Kubernetes worker/control-plane), root on the host compromises all pods. On CI/CD build servers, root enables supply-chain poisoning. On database servers, root means unrestricted data access. Because the kernel is the affected component, ≥90% of installs are definitionally in a role where LPE to root has HIGH+ blast radius. The floor is HIGH.
• Local-only caps at HIGH: AV:L means the attacker must already have a foothold. This is a post-initial-access privilege escalation, not a remote entry point. This single friction point prevents CRITICAL.

Why not higher?

A CRITICAL rating would require either remote exploitability or active in-the-wild exploitation. CVE-2026-43502 is strictly local (AV:L) — the attacker must already have an unprivileged shell on the target. There is no KEV listing and no confirmed campaigns. While the blast radius on high-value roles is severe, the prerequisite of prior access is a meaningful gate that separates this from CRITICAL-tier vulnerabilities like Zerologon or MOVEit.

Why not lower?

Downgrading below HIGH would require the module to be unreachable or the PoC to be unreliable. Neither is the case: RDS auto-loads on default distro configs, the PoC is public and demonstrated, and the affected kernel range spans eight years of production releases. The kernel is the most privileged component on any host — LPE to root is never MEDIUM when a working exploit exists and the module is reachable without admin help.

1. Blocklist the RDS kernel module immediately — Add install rds /bin/true to /etc/modprobe.d/disable-rds.conf and run rmmod rds on hosts where it is loaded but not needed. This eliminates the attack surface entirely. Deploy within 30 days per noisgate mitigation SLA for HIGH. Most enterprise environments do not use RDS (it is Oracle RAC and HPC-specific).
2. Restrict module auto-loading for unprivileged users — Set kernel.modules_disabled=1 after boot or use SELinux/AppArmor to deny sys_module capability to unprivileged processes. This prevents step 2 of the attack chain. Audit with sysctl kernel.modules_disabled.
3. Enable kernel hardening options — Ensure CONFIG_SLAB_FREELIST_HARDENED, CONFIG_SLAB_FREELIST_RANDOM, and KASAN (in test environments) are active. These degrade heap spray reliability and make exploitation significantly harder.
4. Deploy seccomp profiles in container environments — Container workloads should use seccomp profiles that block socket(AF_RDS, ...). The default Docker seccomp profile does NOT block AF_RDS — you need a custom profile. This protects container-to-host escape paths.

Run this script as root on each target Linux host. It checks whether the running kernel is in the affected range and whether the RDS module is loadable. Example: sudo bash check_cve_2026_43502.sh

#!/bin/bash\n# check_cve_2026_43502.sh — CVE-2026-43502 (ZcopyReaper) detection\n# Run as root on each Linux host.\n# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN\n\nset -euo pipefail\n\nKVER=$(uname -r)\necho "[*] Running kernel: $KVER"\n\n# Check for known-patched distro kernels (Ubuntu examples)\nPATCHED=0\ncase "$KVER" in\n  7.0.0-28.28*|6.8.0-13[6-9].*|6.8.0-1[4-9][0-9].*|5.15.0-18[6-9].*|5.15.0-19[0-9].*|5.15.0-2[0-9][0-9].*)\n    PATCHED=1\n    ;;\nesac\n\n# Check mainline version\nMAJOR=$(echo "$KVER" | cut -d. -f1)\nMINOR=$(echo "$KVER" | cut -d. -f2)\nif [ "$MAJOR" -gt 7 ] 2>/dev/null; then\n  PATCHED=1\nelif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -ge 1 ] 2>/dev/null; then\n  PATCHED=1\nfi\n\nif [ "$PATCHED" -eq 1 ]; then\n  echo "[+] PATCHED — kernel $KVER is at or above the fix level."\n  exit 1\nfi\n\n# Check if RDS module is loaded or loadable\nRDS_LOADED=0\nif lsmod | grep -q '^rds '; then\n  RDS_LOADED=1\n  echo "[!] RDS module is currently LOADED."\nfi\n\nRDS_AVAILABLE=0\nif modinfo rds &>/dev/null; then\n  RDS_AVAILABLE=1\n  echo "[!] RDS module is available for auto-loading."\nfi\n\n# Check blocklist\nRDS_BLOCKED=0\nif grep -rqs 'install rds /bin/true\|install rds /bin/false\|blacklist rds' /etc/modprobe.d/ 2>/dev/null; then\n  RDS_BLOCKED=1\n  echo "[*] RDS module is blocklisted in modprobe.d."\nfi\n\nif [ "$MAJOR" -lt 4 ] || { [ "$MAJOR" -eq 4 ] && [ "$MINOR" -lt 17 ]; }; then\n  echo "[+] PATCHED — kernel $KVER predates the vulnerable commit (4.17)."\n  exit 1\nfi\n\nif [ "$RDS_AVAILABLE" -eq 0 ] && [ "$RDS_LOADED" -eq 0 ]; then\n  echo "[*] UNKNOWN — kernel is in affected range but rds.ko not found. Likely not vulnerable."\n  exit 2\nfi\n\nif [ "$RDS_BLOCKED" -eq 1 ] && [ "$RDS_LOADED" -eq 0 ]; then\n  echo "[*] VULNERABLE (mitigated) — kernel in range, RDS blocklisted but not patched."\n  echo "VULNERABLE"\n  exit 0\nfi\n\necho "[!] VULNERABLE — kernel $KVER is in range 4.17–7.1-rc2 and RDS module is reachable."\necho "VULNERABLE"\nexit 0

Sources

1. SecurityOnline — ZcopyReaper PoC Disclosure
2. Ubuntu Security — CVE-2026-43502
3. GitHub Advisory — GHSA-mhq7-fqmq-29pq
4. NVD — CVE-2026-43502
5. NebuSec ZcopyReaper PoC Repository
6. TuxCare — CVE-2026-43494 PinTheft (related RDS vuln)
7. CVEMon — CVE-2026-43502 Overview