A critical vulnerability in the Linux kernel, known as “GhostLock” (CVE-2026-43499), has been disclosed by researchers at Nebula Security.
This vulnerability, which has existed for 15 years, allows for reliable privilege escalation and container escape across nearly all Linux distributions. The issue dates back to Linux kernel version 2.6.39, released in 2011, and remained undetected until recently. It was patched in April 2026.
15-Year-Old GhostLock Linux Kernel Vulnerability
The GhostLock vulnerability is rooted in a stack-based use-after-free (UAF) flaw within the kernel’s real-time mutex (rtmutex) subsystem, as reported by Nebula Security.
Specifically, it originates from a mishandling of the remove_waiter() function in kernel/locking/rtmutex.c, where a task pointer is improperly cleared during priority inheritance (PI) futex operations.
Under certain conditions, especially during FUTEX_CMP_REQUEUE_PI operations, the kernel erroneously clears the pi_blocked_on field of the wrong task. This logic error leaves a dangling pointer pointing to a stack-allocated rt_mutex_waiter structure, which becomes invalid once execution returns to user space.
Exploiting this vulnerability involves a carefully orchestrated interaction among three threads and three futex variables, creating a dependency cycle that forces the kernel onto an -EDEADLK rollback path.
During this rollback, remove_waiter() is incorrectly invoked on behalf of another thread, leading to stale references to freed stack memory. Once this dangling pointer is established, attackers can trigger kernel code paths that dereference it, effectively turning it into a powerful exploitation primitive.
Researchers have shown that this primitive can be leveraged to write controlled data to near-arbitrary kernel memory locations. By reclaiming the freed stack region via system calls such as prctl(PR_SET_MM_MAP), attackers can overwrite the stale rt_mutex_waiter structure with crafted data.
This manipulation enables changes to kernel data structures, including the red-black trees used in mutex wait queues, ultimately allowing controlled pointer writes.
The exploit chain combines several advanced techniques for reliable exploitation. These techniques include bypassing Kernel Address Space Layout Randomization (KASLR) via prefetch-timing attacks, using CPU Entry Area (CEA) memory regions for predictable kernel memory placement, and exploiting kernel function pointer tables, such as inet6_protos. By overwriting the IPv6 UDP protocol handler, attackers can redirect execution and gain full control of the kernel.
In the final stage of the exploit, a technique known as “DirtyMode” is used, where a single kernel write modifies the permission bits of sensitive sysctl entries, such as /proc/sys/kernel/core_pattern.
This allows attackers to execute arbitrary binaries with root privileges, completing the privilege escalation chain. Notably, the exploit has a reported reliability rate of 97% and was successfully demonstrated in Google’s kernelCTF environment, resulting in a reward of over $92,000.
The vulnerability affects all Linux systems running kernels from version 2.6.39 up to 7.1 unless patched. Importantly, the flaw does not require elevated privileges or namespaces, significantly widening its attack surface. Containerized workloads are particularly vulnerable, as the issue enables escape from container isolation into the host system.
A patch has been released to correct the flawed logic by ensuring that the proper task structure (waiter->task) is updated instead of the currently executing thread.
Additional mitigations include enabling RANDOMIZE_KSTACK_OFFSET to make stack reuse less predictable and restricting user-mode helpers via STATIC_USERMODE_HELPER. However, these mitigations serve as defense-in-depth measures and do not substitute the need for immediate patching.
Security teams are strongly advised to update to the latest patched kernel versions without delay. Given the widespread nature of affected systems and the high likelihood of exploitation, GhostLock is one of the most significant vulnerabilities in the Linux kernel disclosed in recent years, posing serious implications for cloud infrastructure, container security, and shared hosting environments.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
, which has existed for 15 years, allows for reliable privilege escalation.){kind=link}