GhostLock CVE-2026-43499: 15-year Linux kernel privilege-escalation bug, high container-escape risk

Nebula Security disclosed GhostLock, a 15-year stack UAF in the Linux kernel rtmutex subsystem. A local unprivileged user can escalate to root and escape containers. Exploit success rate 97%. PoC is public.

On 7 July 2026, Nebula Security disclosed a high-severity local privilege-escalation bug that sat in the Linux kernel for 15 years. CVE-2026-43499. Named GhostLock. It lives in `remove_waiter()` in the rtmutex (realtime mutex) subsystem. Classic stack use-after-free. A local unprivileged user can escalate to root and escape containers.

Overview

GhostLock landed in Linux 2.6.39 (May 2011). It hits nearly every mainstream distro through 7.1. Found by Nebula Security's AI-driven fuzzer VEGA, not manual audit.

Root cause is a logic bug in `remove_waiter()` on the FUTEX_CMP_REQUEUE_PI proxy-lock rollback path. The function should clear the current thread's waiter state. On proxy-lock rollback it instead mutates the requeue initiator's `pi_blocked_on`. The real waiter's `pi_blocked_on` still points at its freed kernel stack frame. Dangling pointer.

Technical details

How it works

After proxy lock fails and rolls back, the sleeping waiter wakes and returns to userspace. The `rt_mutex_waiter` on its kernel stack is freed with the stack frame. That thread's `pi_blocked_on` still points at the freed stack. Next kernel entry reuses the stack. Kernel walks `pi_blocked_on` into the waiter struct. UAF.

Exploit chain

Nebula's public exploit chain has four stages. ~5 seconds. 97% success:

• Trigger dangling pointer: build a three-thread PI dependency cycle; hit the futex_requeue deadlock-detect rollback path
• Stack reuse and object fake: use `prctl(PR_SET_MM, PR_SET_MM_MAP, ...)` to write controlled data at the same offset
• Controlled write primitive: trigger rtmutex rbtree erase; write 8-byte zero to an arbitrary address
• Function-table hijack and privilege escalation: overwrite kernel function tables such as `inet6_protos[IPPROTO_UDP]`; ROP to run privilege-escalation code

Scope

• Affected: Linux kernel 2.6.39 ~ 7.1 (2011 through before April 2026)
• Fixed: Linux 6.1.175+, 6.6.140+, 6.12.86+, 6.18.27+, 7.0.4+
• Prerequisite: `CONFIG_FUTEX_PI=y` (on by default)

Impact

| Dimension | Assessment | |-----------|------------| | CVSS 3.1 | 7.8 High | | Attack vector | Local | | Attack complexity | Low | | Exploit stability | 97% (Nebula test data) | | PoC/EXP | Public |

Risk scenarios

• Local privilege escalation: unprivileged user via webshell or low-priv SSH reaches root
• Container escape: process inside Docker/Kubernetes breaks out to the host
• Multi-tenant cloud: lateral movement on shared hosts and CI/CD runners

Mitigation

Official patch

Upstream fixed it in commit `3bfdc63936dd`. All `current` operations in `remove_waiter()` now use `waiter->task`. Distros have shipped updates:

• Ubuntu: upgrade to the latest kernel for the matching LTS
• Debian: upgrade to 6.12.95+
• RHEL/CentOS: install the matching RHSA patch

Note: the April 2026 initial patch introduced a follow-on bug, CVE-2026-53166. Install the final fix shipped after July.

Temporary mitigations

• Restrict local access for untrusted users. Tighten container privileges.
• Enable kernel hardening: `CONFIG_RANDOMIZE_KSTACK_OFFSET` stack randomization
• Enable Seccomp in containers. Block dangerous ops such as `PR_SET_MM_MAP`
• Monitor for kernel oops and privilege-escalation behavior

References

• Nebula Security: GhostLock Technical Report
• NVD: CVE-2026-43499
• Tencent Cloud security advisory
• Huawei Cloud security alert