GhostLock Linux Kernel Flaw Grants Root Access on Most Distros

Nebula Security has disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel use-after-free vulnerability that lets any local user escalate to full root on unpatched systems and escape containers. The flaw has shipped by default in nearly every mainstream Linux distribution since 2011, requires no special privileges or network access, and can be triggered by ordinary threading calls from any local process. Nebula turned the bug into a working exploit that succeeded 97% of the time on their test hardware in roughly five seconds. Google awarded the team $92,337 through its kernelCTF bug-bounty program after Nebula identified the defect with VEGA, its AI-driven bug-hunting platform.

The bug lives in the kernel's wait queue cleanup path. When a lock operation hits a dead end and has to back out, the cleanup routine runs at the wrong moment and erases the wrong task's record, leaving a stale pointer to already-freed and reused memory. By chaining a small sequence of memory-corruption steps, Nebula's researchers turned that single use-after-free into arbitrary kernel code execution running as root. The kernel code was patched upstream in April via commit 3bfdc63936dd, and the issue carries a CVSS score of 7.8, high but not critical, because an attacker must already have a local shell. Admins running shared, multi-tenant infrastructure should confirm exposure immediately using a port scanner to audit reachable services and a SSL/TLS checker to validate hardened endpoints.

Nebula has published working exploit code, meaning anyone can now weaponize it against laggard systems, though no in-the-wild exploitation has been observed. Patching is the priority, but administrators should not blindly install the first available build: the original fix introduced a secondary crash bug, CVE-2026-53166, whose cleanup was still settling upstream in early July. Ubuntu had patched its newest release and certain cloud kernels but, as of the disclosure window, still listed 24.04, 22.04, and 20.04 LTS as either vulnerable or in progress. Verify your distribution's advisory and confirm the fixed package version, then prioritize cloud servers, containers, and CI runners where a foothold is most likely. Two kernel build options, RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER, raise the bar for exploitation but are mitigations rather than fixes. To reduce the chance an attacker ever gains that local foothold in the first place, run credentials through a password checker and validate that no administrative accounts have appeared in known dumps via the email breach checker.