ZcopyReaper: Critical Linux Kernel Vulnerability Enables Local Privilege Escalation Security researchers at NebuSec have disclosed CVE-2026-43502, a high-severity Linux kernel vulnerability dubbed ZcopyReaper that allows unprivileged local attackers to escalate privileges to root-level control. The flaw affects the Reliable Datagram Sockets (RDS) zero-copy send path, stemming from improper memory cleanup when an RDS zero-copy operation fails after user-space pages are pinned but before the message is attached to the sending socket. The vulnerability arises from a lifetime-management error in the `rds_message_purge()` function, where cleanup logic incorrectly assumes socket association for messages that have not yet entered the queue. This oversight corrupts kernel memory, creating conditions for privilege escalation. ZcopyReaper has existed since Linux kernel version 4.17 and was demonstrated on an openSUSE system running kernel 6.4.0-150600.23.100, proving its practical exploitability beyond denial-of-service attacks. Notably, exploitation does not require Linux capabilities or unprivileged user namespaces, rendering common hardening measures such as disabling user namespace creation ineffective. Affected systems must have `CONFIG_INET`, `CONFIG_AIO`, `CONFIG_RDS`, and `CONFIG_RDS_TCP` enabled, either compiled into the kernel or loaded as modules (`rds.ko` and `rds_tcp.ko`). The upstream fix, introduced in commit 44b550d88b26, modifies `rds_message_purge()` to properly check for the `op_mmp_znotifier` structure before cleanup, ensuring correct zero-copy ownership handling. The patch was merged into Linux 7.1-rc3 and has been backported to stable distributions, including Ubuntu (kernels 7.0.0-28, 6.8.0-136, 5.15.0-186) and Debian. NebuSec’s automated exploit pipeline also confirmed the vulnerability’s exploitability and released proof-of-concept code, heightening the urgency for administrators to apply vendor-provided kernel updates. Where immediate patching is not feasible, mitigations include disabling unnecessary RDS modules though disabling user namespaces alone does not prevent exploitation.

Dirty Frag: New Linux Kernel LPE Vulnerability Grants Root Access Across Major Distros A newly disclosed Linux kernel vulnerability, dubbed Dirty Frag, enables local privilege escalation (LPE) by chaining two page-cache write flaws xfrm-ESP Page-Cache Write and RxRPC Page-Cache Write to achieve root access on nearly all major Linux distributions. The exploit, publicly released on May 7, 2026, following an embargo break, leverages a deterministic logic flaw rather than race conditions, ensuring a high success rate without kernel panics. Discovered by security researcher Hyunwoo Kim (@v4bel), Dirty Frag exploits the kernel’s zero-copy send path, where `splice()` inserts a reference to a read-only page cache (e.g., `/etc/passwd` or `/usr/bin/su`) into the `frag` slot of a sender-side `sk_buff`. Receiver-side cryptographic operations then modify the page cache in-place, corrupting files even for unprivileged users. ### Exploit Mechanics 1. xfrm-ESP Variant: - Targets `esp_input()` in the IPsec ESP receive path, skipping buffer allocation checks (`skb_cow_data()`) for non-linear `skb`s. - Attackers use `XFRMA_REPLAY_ESN_VAL` to overwrite arbitrary bytes (e.g., `/usr/bin/su`) with a root-shell ELF, requiring user namespace creation (`unshare(CLONE_NEWUSER)`), which is blocked on some Ubuntu systems via AppArmor. 2. RxRPC Variant: - Exploits `rxkad_verify_packet_1()` to perform in-place decryption on the first 8 bytes of an RxRPC payload. - Attackers brute-force a session key to manipulate plaintext (e.g., emptying `/etc/passwd`’s password field), bypassing PAM authentication. This variant does not require namespace privileges but relies on the `rxrpc.ko` module, absent by default on RHEL but present on Ubuntu. Chaining both exploits ensures root access across distributions, with the PoC first attempting the ESP path before falling back to RxRPC if `unshare` fails. ### Affected Systems The vulnerabilities span nine years, with the ESP flaw introduced in January 2017 (commit `cac2661c53f3`) and the RxRPC flaw in June 2023 (commit `2dc334f1a63a`). Confirmed affected distributions include: - Ubuntu 24.04.4 (kernel 6.17.0-23) - RHEL 10.1 (kernel 6.12.0-124.49.1) - openSUSE Tumbleweed (kernel 7.0.2-1) - CentOS Stream 10, AlmaLinux 10, Fedora 44 ### Patches & Mitigation - The ESP patch, using `SKBFL_SHARED_FRAG` to enforce buffer isolation, was merged into the netdev tree on May 7, 2026. - The RxRPC patch remains unmerged upstream. - No CVEs have been assigned due to the premature embargo break. - Temporary mitigation involves blacklisting the affected modules (`esp4`, `esp6`, `rxrpc`) via: ```bash sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true" ``` This disrupts IPsec and RxRPC functionality, requiring careful evaluation for systems reliant on VPNs. The full technical write-up and PoC are available on the researcher’s GitHub repository.

DirtyDecrypt: Linux Kernel Vulnerability Enables Local Privilege Escalation to Root A newly disclosed high-severity Linux kernel vulnerability, DirtyDecrypt (CVE-2026-31635), allows local attackers to gain full root access on affected systems. The flaw, attributed to a missing copy-on-write (COW) guard in the `rxgk_decrypt_skb()` function of the RxGK subsystem, enables unprivileged users to overwrite privileged memory pages including critical files like `/etc/shadow`, `/etc/sudoers`, or SUID binaries by decrypting crafted socket buffers. The issue was reported on May 9, 2026, by security researcher V12, who described it as an "rxgk pagecache write due to missing COW guard." Kernel maintainers later confirmed it as a duplicate of an internally patched flaw, with the fix merged upstream on April 25, 2026. ### Affected Systems DirtyDecrypt impacts Linux distributions that compile the kernel with `CONFIG_RXGK=y` or `CONFIG_RXGK=m`, primarily rolling-release versions: - Fedora (including Rawhide and Workstation, pre-patch) - Arch Linux (before `pacman -Syu`) - openSUSE Tumbleweed (before `zypper dup`) - Systems using mainline kernel PPAs or ELRepo kernel-ml on RHEL/CentOS Stream Stable enterprise distributions (Debian Stable, RHEL 8/9, Ubuntu LTS) are not affected by default, as they ship with RxGK disabled. Administrators can verify exposure via: ```bash zcat /proc/config.gz | grep RXGK ``` ### Exploitation Risks The vulnerability poses a critical threat in containerized environments, where a successful exploit on a Kubernetes worker node could lead to a full container escape. Attackers gaining root on the host would access all pods, container runtime sockets, and Kubernetes secrets mounted on the node. High-risk targets include: - Developer workstations (Fedora/Arch) with active `kubectl` contexts - Systems storing AWS credentials or SSH keys - Enterprise production environments DirtyDecrypt is the fourth Linux kernel local privilege escalation (LPE) flaw in the XFRM/ESP/rxgk attack surface within three weeks, following the actively exploited Copy Fail family of vulnerabilities. ### Mitigation The primary fix is updating the kernel to include the April 25 patch: ```bash # Fedora sudo dnf upgrade --refresh kernel kernel-core kernel-modules && sudo systemctl reboot # Arch Linux sudo pacman -Syu linux linux-headers && sudo systemctl reboot # openSUSE Tumbleweed sudo zypper dup && sudo systemctl reboot ``` For systems unable to patch immediately, blacklisting `rxrpc`, `esp4`, and `esp6` kernel modules provides a temporary workaround though this may disrupt IPsec VPNs and AFS mounts. Kubernetes operators should rebuild worker node images with the patched kernel and enforce pod security standards (e.g., `restricted` profile, `allowPrivilegeEscalation: false`). Given the availability of public proof-of-concept (PoC) code, users on affected distributions are advised to prioritize updates.