Security researchers at Nebula Security’s VEGA team have disclosed GhostLock (CVE-2026-43499), a use-after-free vulnerability in the Linux kernel’s real-time mutex (futex priority-inheritance) code that has been sitting unpatched for approximately 15 years — present in all kernel versions from 2.6.39-rc1 through 7.1-rc1. The flaw allows an unprivileged local user to escalate privileges to root, and also enables container escapes in multi-tenant environments. A working proof-of-concept was published alongside the disclosure on July 7, 2026.
The root cause lies in a cleanup routine within kernel/locking/rtmutex.c that incorrectly clears the wrong thread’s bookkeeping when a lock request is unwound due to a deadlock. This leaves a pointer dangling into a freed region of kernel stack. An attacker can then reclaim that memory, forge a kernel structure, and convert the dangling pointer into a controlled kernel write — achieving a root shell. Researchers report a 97% reliability rate, with a stable root shell appearing in approximately five seconds. The current weaponized PoC targets ARM64 Android devices, but the full x86_64 exploitation chain has been documented and public weaponization is expected shortly. The vulnerability was fixed in Linux 7.1.
Affected distributions include all major Linux distros running unpatched kernels prior to 7.1, as well as Android. GhostLock joins Bad Epoll (CVE-2026-46242), disclosed days earlier, as the second high-reliability Linux local root exploit published this week, making this an unusually active period for Linux kernel privilege escalation research.
Sources
- The Hacker News — 15-Year-Old GhostLock Flaw Enables Root
- CloudLinux — GhostLock CVE-2026-43499 Kernel Update
- SecurityOnline — GhostLock Technical Overview
Commentary
A 15-year-old kernel flaw with a 97% reliable exploit published the same week as another local root PoC is the kind of week that makes Linux sysadmins earn their pay. The container-escape angle is what makes GhostLock particularly dangerous in practice: cloud-hosted multi-tenant environments, VPS providers, and container orchestration platforms are all in scope. An attacker who lands initial access via a compromised web application now has a highly reliable, near-instant path to owning the entire host and every tenant on it.
Red teamers and penetration testers should expect this to land in post-exploitation frameworks quickly — the x86_64 chain has been fully documented, so the lift to a Metasploit or Cobalt Strike module is not significant. Prioritize patching to Linux 7.1 or applying your distro’s kernel update, and if you’re running container workloads on unpatched kernels, treat this as an emergency. Live-patching solutions like KernelCare and kpatch are available for environments that can’t tolerate a reboot immediately.