GhostLock (CVE-2026-43499): A 15-Year-Old Linux Kernel Stack-UAF Vulnerability Affecting All Distributions

What is GhostLock?

In July 2026, researchers at cybersecurity firm Nebula Security (VEGA group) published details of a critical vulnerability called GhostLock (CVE-2026-43499). It is a stack-use-after-free (stack-UAF) vulnerability in the Linux kernel's rtmutex locking mechanism that existed in every major Linux distribution for the past 15 years — from Linux 2.6.39 (2011) through Linux 7.1.

The vulnerability allows an unprivileged local attacker to gain root access via Local Privilege Escalation (LPE) or perform container escape. Google paid the VEGA researchers $92,337 through the kernelCTF program after they demonstrated a stable exploit with 97% reliability that runs in approximately 5 seconds.

The name "GhostLock" symbolizes that the vulnerability was "hiding like a ghost" in the kernel for nearly two decades, while "Lock" refers to the rtmutex locking mechanism where the bug was found.

Technical Overview

GhostLock exists in the Linux kernel from version 2.6.39 (2011) through version 7.1. The vulnerability was introduced with the rtmutex refactoring in commit 8161239a8bcc and remained undetected for about 15 years until it was fixed in April 2026 in commit 3bfdc63936dd.

The root cause is a bug in the remove_waiter() function in kernel/locking/rtmutex.c. The function clears current->pi_blocked_on, which is correct for the normal slow path where current is the task owning the waiter. However, this is incorrect for the proxy path when rt_mutex_start_proxy_lock() unwinds on behalf of another task.

Attack Vector

To reach the -EDEADLK state, the attacker needs to create a PI dependency cycle of three futex words and three threads. After successful exploitation, the attacker gains a pointer to freed kernel stack memory and the ability to write a pointer to a nearly arbitrary address.

The exploit stability is notable — 97% across multiple kernel versions and configurations.

Who Is Affected?

GhostLock affects ALL major Linux distributions. If you run any Linux system, you are affected. This includes Ubuntu, Debian, RHEL, CentOS, Fedora, Arch Linux, SUSE, and all derivatives.

Patching and Mitigation

The fix is included in Linux kernel commit 3bfdc63936dd. System administrators should apply kernel patches immediately.

Implications for Georgia

Many Georgian businesses and organizations run Linux servers — from hosting providers to banks to government systems. We recommend immediately reviewing and patching all Linux systems.

Conclusion

GhostLock serves as a reminder that even mature, battle-tested codebases like the Linux kernel can harbor critical vulnerabilities for years. The bug existed for 15 years and was discovered only accidentally during unrelated research.

SiTech recommends all clients running Linux servers apply the latest kernel patches immediately.