“GhostLock” flaw survived in the Linux kernel code for 15 years

A Linux kernel vulnerability remained hidden in virtually every major Linux distribution for more than 15 years before being fixed earlier this year.

The flaw, tracked as CVE-2026-43499 and dubbed GhostLock, can be exploited by an unprivileged local attacker to gain root privileges and escape containers. It has earned its discoverers at Nebula Security a $92,337 reward from Google's kernelCTF program.

According to Nebula’s technical analysis, the bug can be leveraged to escalate privileges, with a reported 97% success rate. GhostLock was introduced in Linux 2.6.39 in 2011 and remained in the kernel until it was fixed in Linux 7.1, affecting every major Linux distribution that had not yet applied the patch.

The Linux kernel is the core component of Linux-based operating systems, managing hardware resources, memory, and processes. It is used by servers, desktops, embedded systems, cloud platforms, and Android devices, making kernel vulnerabilities particularly valuable to attackers, as successful exploitation can result in a complete system compromise.

GhostLock originates from a bug in the kernel's real-time mutex (rtmutex) locking code used by the futex priority inheritance mechanism. Due to an incorrect cleanup operation, the kernel can retain a dangling reference to memory on a thread's stack after that memory is no longer valid. An attacker can then reclaim that memory with controlled data, eventually obtaining the ability to redirect kernel execution and achieve root privileges.

While Nebula Security's exploit relies on several advanced techniques to bypass modern kernel protections and reliably hijack kernel execution, the underlying bug is relatively straightforward. A helper function originally written for one execution path was later reused in another where it mistakenly updated the state of the currently running thread instead of the thread that actually owned the affected kernel object.

According to the researchers, exploiting GhostLock does not require elevated privileges, user namespaces, or unusual kernel configurations. Systems are affected as long as they are built with CONFIG_FUTEX_PI enabled, which is the default in most general-purpose Linux kernels.

The vulnerability was reported to the Linux kernel security team on April 18, 2026, together with a proposed fix. A different patch addressing the issue was merged two days later, and stable kernel backports began rolling out in early May. Google acknowledged Nebula Security's successful kernelCTF submission on June 30, and the researchers published their technical write-up following a coordinated disclosure.

The official fix ensures that the kernel clears state information for the correct waiting task, eliminating the dangling pointer that enabled the exploit. Nebula Security also notes that enabling hardening features such as RANDOMIZE_KSTACK_OFFSET makes its published exploitation technique significantly less reliable, although updating to a patched kernel remains the only complete mitigation.

Linux users and administrators should install kernel updates provided by their distribution as soon as they become available. Because GhostLock requires local code execution, limiting untrusted access to systems and keeping kernels up to date remain the most effective defenses against exploitation.