Nebula Security’s VEGA team disclosed GhostLock (CVE-2026-43499) on July 7, 2026 — a stack use-after-free vulnerability in the Linux kernel’s priority inheritance futex subsystem that allows any unprivileged local user to obtain a root shell in approximately five seconds, affecting every Linux kernel from version 2.6.39 through 7.1.
The flaw was present in the codebase for roughly 15 years before researchers discovered it during an audit of the kernel’s locking code. Google awarded the VEGA team $92,337 through its kernelCTF bug bounty program. A working proof-of-concept was published alongside the disclosure writeup at nebusec.ai.
What Is GhostLock (CVE-2026-43499)?
GhostLock is a local privilege escalation (LPE) vulnerability in the Linux kernel’s kernel/locking/rtmutex.c file. The defect is a mishandling of remove_waiter() during a FUTEX_CMP_REQUEUE_PI operation: the pi_blocked_on field of the wrong task gets cleared, leaving a dangling pointer on the stack that an attacker can exploit to execute arbitrary code as root.
GhostLock is part two of Nebula Security’s “IonStack” research series. Part one disclosed a separate kernel vulnerability earlier in 2026; both were found during the same code audit of the futex priority inheritance subsystem.
How Does the GhostLock Exploit Work?
The exploit requires zero special privileges — only a standard shell account on the target machine. According to Nebula Security, the exploit produces a stable root shell approximately 97% of the time in roughly five seconds. The only kernel configuration requirement is CONFIG_FUTEX_PI=y, which is enabled by default on every Linux distribution tested.
In multi-tenant environments — shared hosting, cloud VMs, and containerized services — GhostLock also enables container escape, allowing an attacker to move from an isolated container to the host machine. As Nebula Security wrote in the disclosure: “a single compromised site, a low-trust shell account, or a hacked plugin can go from an ordinary process to full control of the machine, and every other customer on it, in seconds.”
Which Linux Kernels and Distros Are Affected?
CVE-2026-43499 affects Linux kernel versions 2.6.39 through 7.1 — a range introduced around 2011. All major distributions that shipped kernels in this range are affected, including Ubuntu, Debian, Fedora, RHEL, and Arch Linux. CloudLinux confirmed it has issued a kernel update specifically for GhostLock. The flaw is fixed in Linux 7.1.
No confirmed in-the-wild exploitation was reported in the Nebula Security writeup, but the 15-year window of exposure means silent exploitation cannot be ruled out.
How to Fix GhostLock (CVE-2026-43499)
The fix is available in Linux kernel 7.1. Updating to Linux 7.1 or later closes the vulnerability. To check the current kernel version, run uname -r in a terminal. Any version below 7.1 is vulnerable and should be updated using the distribution’s standard package manager (apt, dnf, pacman, or equivalent). CloudLinux users should apply the vendor’s dedicated kernel update.
Organizations running containerized workloads or shared hosting environments should treat this as a critical-priority patch because the container escape capability expands the blast radius beyond a single compromised account.
Our Take
A 15-year-old kernel bug with a 97% success rate root shell is the kind of flaw that makes security researchers lose sleep — not because it required sophisticated techniques, but because it hid in plain sight in one of the most audited codebases in the world. The futex subsystem is complex, and the defect is subtle enough that it survived years of review. Check your kernel version today: uname -r. If it reads below 7.1, you are running a root-exploitable machine.
For Context — CVE and Security Coverage on WithO2.com
- Claude Mythos Caused a 3.5× Spike in Critical CVE Disclosures — how AI-assisted research is accelerating the rate at which kernel and application vulnerabilities reach public disclosure.
- Cursor 0day: Cloning a Repo Can Hack Your Computer — a supply-chain vulnerability in developer tooling that required no elevated privileges to trigger.
