CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Linux kernel net/rds zerocopy op_nents double drop (PinTheft), CVSS 7.8

cve · CVE-2026-43494 single-source

Coverage
1
first 2026-05-21 → last 2026-10-21
Latest activity
2026-05-21
PinTheft gives a local user root through an RDS zerocopy double-free, wherever the RDS kernel module is loaded
Peak priority
notable
1 notable
Targets
technology
sectors: technology
Sources cited
3
3 hosts

Defender insights

What each entry about CVE-2026-43494 tells a defender to do, newest first.

2026-05-21NOTABLEPinTheft gives a local user root through an RDS zerocopy double-free, wherever the RDS kernel module is loaded

Exposure · detection

Story timeline

  1. 2026-05-21PinTheft: Linux kernel RDS zerocopy double-free (CVE-2026-43494) turned into a root exploit through io_uring fixed buffers, public PoC; V12 found RDS loaded by default only on Arch Linux among the distributions it tested
    trending-vulnerabilitiesPinTheft gives a local user root through an RDS zerocopy double-free, wherever the RDS kernel module is loaded

Hunting pivots

Affected products
Linux kernel
Tags
lpepatch-availablepoc-publicvulnerabilities
ATT&CK techniques (1 across 1 tactic)

1 technique observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-05-21/pintheft-linux-kernel-local-privilege-escalation-primitive-r · ATT&CK page ↗

Entries about Linux kernel net/rds zerocopy op_nents double drop (PinTheft), CVSS 7.8 (1)

2026-05-21 · view entry permalink →

NOTABLECVE-2026-43494updatedNATOB2

PinTheft: Linux kernel RDS zerocopy double-free (CVE-2026-43494) turned into a root exploit through io_uring fixed buffers, public PoC; V12 found RDS loaded by default only on Arch Linux among the distributions it tested

V12 Security released PinTheft with a proof-of-concept exploit on 2026-05-19, and Gentoo's Sam James relayed it to the oss-security list the same day; Aaron Esau of the V12 team found the bug (oss-security, 2026-05-19). In the RDS zerocopy send path, rds_message_zcopy_from_user() pins user pages one at a time; when a later page faults, the error path drops the pages already pinned while the scatterlist entries stay live, so message cleanup drops them again and each failed send steals a reference from the first page (oss-security, 2026-05-19). The exploit registers an anonymous page as an io_uring fixed buffer, which gives it a FOLL_PIN bias of 1024 references, steals those references with failing RDS zerocopy sends, lets the page be reclaimed as page cache of a SUID-root binary and overwrites it through the stale fixed-buffer pointer with a small ELF payload, so running the binary drops into a root shell (oss-security, 2026-05-19). It needs the RDS modules, io_uring enabled, a readable SUID-root binary and x86_64 for the included payload (BleepingComputer, 2026-05-20). The bug was patched upstream earlier in May (BleepingComputer, 2026-05-20), and the kernel CNA published that fix, which resets op_nents in rds_message_zcopy_from_user(), as CVE-2026-43494 (CVSS 7.8) on 2026-05-21 (ENISA EUVD-2026-31267).

PinTheft is a Linux local privilege escalation exploit for an RDS

oss-security (Sam James, relaying V12 Security) 2026-05-19

Sadly, the RDS kernel module this requires is only default on Arch Linux among the common distributions we tested

Linux users on affected distros are advised to install the latest kernel updates as soon as possible.

BleepingComputer 2026-05-20
Improvementrun 2026-10-21T1148Z-auditaffected_productsbodyclassificationcvesevent_dateevidenceheadlinekindsourcessourcing_notesummarytechniquestitleverification

V12 found the RDS module (CONFIG_RDS with CONFIG_RDS_TCP) enabled by default only on Arch Linux among the common distributions it tested; it did not establish that the module is off on every other distribution (oss-security, 2026-05-19). Aaron Esau of V12 found the bug and V12 released the exploit, which Gentoo's Sam James relayed to oss-security (oss-security, 2026-05-19). The kernel fix was published as CVE-2026-43494 (CVSS 7.8) on 2026-05-21 (ENISA EUVD-2026-31267), and the mitigation for hosts that cannot take the fixed kernel yet is to unload and block the rds_tcp and rds modules (BleepingComputer, 2026-05-20).

vulnerability21 May 05:00Zsingle-sourceOpen finding →
Sources: oss-security (Sam James, relaying V12 Security) · BleepingComputer · ENISA EUVD-2026-31267

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bleepingcomputer.com1 (33%)
  • euvd.enisa.europa.eu1 (33%)
  • openwall.com1 (33%)

External references

NVD · cve.org · CISA KEV

All cited sources (3)