GhostLock: A 15-Year-Old Linux Kernel Flaw That Ships on Every Mainstream Distro
Nebula Security disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel flaw in futex priority-inheritance code that grants unprivileged users root access and container escape.
A vulnerability introduced into the Linux kernel in 2011 has been sitting in essentially every mainstream distribution since then, waiting to be found. GhostLock, disclosed this month by researchers at Nebula Security as CVE-2026-43499, is a use-after-free in the kernel’s real-time mutex priority-inheritance code that allows any unprivileged local user to gain root access — and to escape from containers to the host while doing it.
The flaw dates back to Linux 2.6.39, released in May 2011, when the futex priority-inheritance implementation was reworked. Nebula Security found it using their automated analysis tool VEGA, and the bug survived fourteen years because it lives in a relatively obscure corner of the kernel’s synchronization primitives: the path where a priority-inheritance mutex handles owner death. An unprivileged user can trigger the use-after-free by manipulating the ordering of futex operations, eventually obtaining a dangling pointer that can be redirected to attacker-controlled memory. From there, the exploit chains through to full root privileges.
What makes this particularly significant for modern deployments is that the same primitive works from inside a container. No special capabilities are required — the attacker just needs a shell as an ordinary user. The Nebula team turned their discovery into a working exploit that achieves root and container escape with 97% reliability, demonstrating that the isolation boundaries many systems rely on are not actually boundaries at all when the underlying kernel can be compromised this way. Google awarded Nebula $92,337 through its kernelCTF bug-bounty program for the disclosure.
The vulnerability has shipped by default in every major distribution for well over a decade. That means a very large number of running systems — servers, workstations, cloud instances, embedded devices — carry this code path whether they use real-time scheduling features or not. The kernel’s rtmutex subsystem is compiled in by default on most configurations, so the attack surface is present even on systems with no explicit real-time workload.
A fix has been committed to mainline as of commit 3bfdc63936dd, included in Linux 7.1. For administrators, the immediate question is patch availability from their specific distribution, and whether they can distinguish between systems that have already been targeted — the exploit leaves no particular forensic signature — and those that have not. The fourteen-year window means that if this had been found by a different research team, or by someone who preferred not to disclose, the Linux ecosystem would have had no way to know. That it was found by a group willing to report it through coordinated disclosure, and that the exploit details are now public, is the only reason the patch exists at all.