Reported by 2 outlets
CVE-2026-43499 "GhostLock": 15-Year-Old Linux Kernel Flaw Enables Root and Container Escape
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 3.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.22 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
CVE-2026-43499 "GhostLock": 15-Year-Old Linux Kernel Flaw Enables Root and Container Escape
arstechnica.com · 97d ago · July 9th, 2026
Gap detection: surfaced via community cross-reference — not ingested by Miniflux Cyber feeds.
Researchers at Nebula Security have disclosed GhostLock (CVE-2026-43499, CVSS 7.8), a use-after-free vulnerability in the Linux kernel's futex priority-inheritance code that has lurked in the kernel since 2011 — 15 years. The flaw resides in the cleanup step of the rt_mutex/futex machinery: when a lock operation hits a dead end and backs out, the cleanup runs at the wrong moment and wipes the wrong task's record, leaving the kernel holding a dangling pointer to freed memory. Nebula chained this into full root privilege escalation.
The vulnerability affects every mainstream Linux distribution and enables both local root escalation and container escape — making it particularly dangerous in multi-tenant cloud environments. GhostLock was discovered using Nebula's AI-assisted Vega vulnerability scanner and earned a $92,337 bounty through Google's kernelCTF program. A separate, related KVM flaw (Januscape, CVE-2026-53359) also surfaced this week with a $250,000 bounty — covered in the July 7 digest.
Hunting hypothesis: An unprivileged local user or compromised container process exploits a race condition in the futex priority-inheritance cleanup path to gain a dangling kernel pointer, escalates via ROP chain to root, and escapes the container boundary.
Recommended action: Apply latest kernel updates from your distribution immediately. Container host kernels are the highest-priority patch targets.
-
update from securityweek.com
GhostLock (CVE-2026-43499) — 15-Year-Old Linux Kernel Use-After-Free With PoC
securityweek.com · 96d ago · July 10th, 2026
Nebula Security published exploit code for GhostLock, a use-after-free vulnerability in the Linux kernel present since kernel 2.6.39 (2011) across all major distributions. The flaw exists in a task-priority cleanup helper function — when a deadlock triggers a rollback, memory is freed while a dangling pointer remains in another task, enabling local privilege escalation to root. Patched in April 2026.