In a nutshell: The 15-year-old Linux kernel vulnerability GhostLock (CVE-2026-43499) enables root access via local threading calls on nearly all distributions, while patch distribution remains irregular.
The Linux security vulnerability GhostLock (CVE-2026-43499) enables local attackers to obtain complete root privileges and escape containers. The vulnerability, which has existed since 2011, is located in the priority inheritance system and affects nearly all common distributions. Neither administrative rights nor network access are required to exploit it.
Researchers from Nebula Security have documented a critical vulnerability in the Linux kernel that has existed undetected for at least 15 years. CVE-2026-43499, named GhostLock, is part of a growing series of automatically discovered kernel vulnerabilities. The flaw lies in the kernel’s priority inheritance mechanism, which causes a use-after-free error when processing lock operations – the system references memory areas that have already been freed and reassigned. Google recognized the discovery as part of its kernelCTF program with a bounty of 92,337 US dollars.
As local attackers, you only need ordinary threading calls from a local program for exploitation – neither network access nor elevated system privileges are required. The research team has published functional exploit code with a reliability of 97 percent and demonstrated a complete attack chain called IonStack, which combines GhostLock with a Firefox vulnerability (CVE-2026-10702) – through a malicious link on Android devices, attackers can break out of the browser sandbox and subsequently from the entire operating system.
The patch 3bfdc63936dd was released in April, but distribution remains irregular. Early bug fixes caused a separate system crash (CVE-2026-53166), which means administrators must switch directly to newer kernel versions. Major distributions such as Ubuntu have only partially patched or are still testing older LTS versions such as 24.04, 22.04, and 20.04. Certain build options such as RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER complicate exploitation, but do not replace a complete patch and only serve as mitigation measures.
For CISOs in shared systems, cloud infrastructure, and container environments, prioritization is essential: these deployments allow local attackers direct kernel access and are therefore primary attack targets. Although no active exploits in the wild are currently known, affected Linux kernels should be updated to patched versions to prevent both privilege escalation and container breakouts.
Source: www.it-daily.net · Published July 13, 2026
Lumi AI News — AI-assisted curation in accordance with Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.