News

Security researchers at Nebula Security have revealed a long-standing Linux kernel vulnerability they call GhostLock (CVE-2026-43499). The defect, present in default kernel builds shipped by essentially every major distribution since about 2011, allows any user with a local account to elevate to full root privileges on an unpatched system. It requires no special system configuration, no network access and no privileged starting point – simple, routine threading or futex calls from a local process are sufficient to trigger it.

Nebula converted the underlying flaw into a working exploit that, in their tests, succeeds roughly 97% of the time and can also escape container sandboxes. The team says Google rewarded the finding with $92,337 through the kernelCTF bug bounty program. While there are no public reports of active exploitation in the wild so far, Nebula has published exploit code, meaning anyone with local access can now run it. Fixing vulnerable systems is therefore urgent.

How the defect operates: the kernel implements priority inheritance and related cleanup logic to prevent urgent tasks from getting permanently blocked by lower-priority ones. In the specific edge case that GhostLock targets, a lock operation must abort and unwind; during that rollback the cleanup routine can execute at an incorrect time and erase a record belonging to a different task. That leaves the kernel with a stale pointer referencing memory that has already been freed and potentially reused – a classic use-after-free vulnerability. Nebula chained several additional steps to weaponize that memory corruption and trick the kernel into executing attacker-controlled code in ring 0, effectively granting root. On their lab hardware they say the full escalation commonly completes in about five seconds.

The bug traces back to futex priority inheritance code introduced around 2011 and was patched upstream in April (commit 3bfdc63936dd). The vulnerability affects nearly all Linux distributions and has been assigned a CVSS score of 7.8 (high) because an attacker must already have an account on the target machine. Nebula reports discovering GhostLock using VEGA, its AI-driven vulnerability discovery tool.

What administrators should do: install the current kernel package for your distribution – not merely the initial patched build. The first remediation introduced a separate crash issue (CVE-2026-53166), and fixes for that follow-up were still being finalized upstream as of early July, so early patched kernels may not contain the final, cleaned-up change. There is no complete workaround short of upgrading because the triggering operations are normal behavior for local processes.

Patch availability varies by vendor. For example, Ubuntu had updated its latest release and some cloud-specific kernels, but as of early July the LTS releases 24.04, 22.04 and 20.04 still appeared as vulnerable or in the process of receiving fixes. Always check your distribution’s advisory and ensure the package version installed includes the confirmed final fix rather than assuming a pending update is sufficient.

Two kernel build options can make exploitation more difficult – RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER – but these are mitigations rather than full resolutions. Prioritize patching systems where multiple tenants or untrusted users might gain local access: shared machines, cloud servers, containers, CI runners and other multi-tenant infrastructure should be fixed first.

GhostLock is part of a string of 2026 Linux privilege escalation bugs, many discovered by automated tools. Nebula’s VEGA found GhostLock; days earlier researchers disclosed Bad Epoll (CVE-2026-46242), a related vulnerability that also yields root from an unprivileged account and was demonstrated via kernelCTF – notably, Bad Epoll also works on Android. Anthropic’s Mythos model has been credited with discovering a related weakness in the same code area. These issues tend to live in old, widely used kernel code paths that few engineers had re-audited until automated analysis began re-examining them; futex PI has been in the kernel since 2011.

The class of bugs is not merely academic: another 2026 kernel issue, Copy Fail (CVE-2026-31431), has already been placed on CISA’s catalogue of vulnerabilities observed in real attacks. GhostLock is additionally significant because it completes a cross-component attack chain Nebula calls IonStack. The first link in that chain is CVE-2026-10702, a Firefox vulnerability that allows code to run inside the browser and break out of the renderer sandbox; GhostLock can then be used to move from that sandbox to full root. Nebula demonstrated the entire sequence – from a single click on a malicious link to total control – against Firefox on Android and says a detailed write-up of the Android exploit is forthcoming.

In short: although GhostLock is a local-only kernel bug by design, pairing it with a remote vector such as a browser sandbox escape turns it into a remote compromise. Administrators should verify and install the finalized kernel updates immediately, with special attention to cloud and shared environments where an attacker is most likely to obtain the local access this flaw requires.