GhostLock exploit code goes public for Linux root bug that lurked for 15 years

Researchers at Nebula Security have published a full technical writeup and working exploit code for GhostLock (CVE-2026-43499), a use-after-free vulnerability in the Linux kernel that has existed in every major distribution since 2011. The exploit achieves privilege escalation to root with 97% stability and can also be used for container escape, making it one of the most reliable local privilege escalation exploits seen in recent memory.

A 15-year-old oversight in the kernel's locking code

GhostLock lives in kernel/locking/rtmutex.c, specifically in the remove_waiter() function that handles real-time mutex (rtmutex) priority inheritance. The bug was introduced in Linux 2.6.39 in a commit from 2011 and went unpatched for approximately 15 years until April 2026.

The flaw stems from a subtle mishandling of task pointers during priority inheritance (PI) futex operations. When a thread is removed from a waiter list, the function incorrectly clears the pi_blocked_on field of the calling task rather than the correct task being removed. An unprivileged attacker can trigger this condition using only standard threading system calls, obtaining a dangling kernel pointer to stack memory.

From there, the attack chain allows writing a pointer to nearly any kernel address and hijacking a function table to gain full control flow, ultimately landing a root shell. The exploit requires CONFIG_FUTEX_PI to be enabled — which is the default configuration on virtually all Linux distributions.

Awarded $92,337 in Google's kernelCTF

Nebula Security first demonstrated GhostLock through Google's kernelCTF competition, where they received a $92,337 reward for the working exploit. The team's Part 2 writeup, published July 7, provides a complete exploitation roadmap including the heap-layout techniques used to achieve the 97% success rate across kernel versions from 2.6.39 through 7.1-rc1.

As first reported by Nebula Security, the vulnerable range spans the vast majority of kernels shipped by major distributions over the past 15 years. Any system running a kernel from that range without the April 2026 patch set is still exploitable by a local user.

Patch is available — but many systems remain unprotected

Linux kernel maintainers shipped the fix in April 2026 via commits to the stable tree, and major distributions have included the patch in their most recent LTS kernel updates. However, with public exploit code now available, any unpatched system running Linux where an untrusted user can log in locally is at serious risk.

Container environments deserve particular attention: a container breakout via GhostLock gives an attacker root on the underlying host, bypassing all container isolation. Cloud providers running shared multi-tenant environments on unpatched kernels should treat this as a P0 issue.

What to do now

System administrators should immediately verify their kernel version and update to the latest distribution LTS release if they have not already done so. The fix is in the stable kernel tree and has been backported across supported LTS branches. Distributions including Ubuntu, Debian, Fedora, Red Hat Enterprise Linux, and Alpine have all issued updated packages.

Running uname -r and comparing against your distribution's patched kernel version is the fastest way to check exposure. Until patching is complete, restricting local user access and auditing for unusual privilege escalation attempts in audit logs is advisable.