Researchers from Nebula Security recently revealed details about 18 vulnerabilities found in the Linux kernel, along with prepared exploits that could potentially enable an unprivileged local user to obtain root privileges on the system. These vulnerabilities have since been addressed in several kernel updates released throughout the spring and summer.
Among the issues identified, one significant vulnerability was named CVE-2026-43502, which involved a flaw in the RDS (Reliable Datagram Sockets) network subsystem. This vulnerability, known as ZcopyReaper, was caused by improper handling of pinned memory pages during data transmission in mode fails zerocopy before the message is queued. Initially appearing in kernel version 4.17, the problem was fixed in the kernel during May. The exploit for this vulnerability was demonstrated in openSUSE using the stock 6.4 kernel.
Another vulnerability, designated as CVE-2026-80714, was discovered in the IPVS (IP Virtual Server) subsystem. This vulnerability stemmed from an incorrect setting of the IP_VS_CONN_F_ONE_PACKET flag during connection synchronization, which resulted in dangling pointers in the hash table after the connection lifetime expired. This issue was rectified on August 19, and the exploit was demonstrated on Debian 13 with kernel 6.12.
Furthermore, a vulnerability known as CVE-2026-74597 was identified in the ip6_tunnel driver, caused by an erroneous offset application to the HAO (Home Address Option) option from an external package. This led to potential data leakage beyond the allocated buffer when generating an ICMP response. The problem was fixed on August 19, and the exploit was shown to be applicable on CentOS with kernel 6.12.
One more vulnerability, CVE-2026-74581, was also listed among the identified issues, although specific details regarding this particular vulnerability were not provided in the report.