Nebula Security disclosed GhostLock, a Linux kernel vulnerability tracked as CVE-2026-43499 that affected major distributions across a 15-year kernel range.
The company said its VEGA research team turned the bug into a 97% stable privilege escalation and container escape, earning $92,337 through Google’s kernelCTF program.
GhostLock sits in the kernel’s real-time mutex, or rtmutex, handling for priority inheritance futexes. Linux maintainers introduced the affected code path in Linux 2.6.39 and fixed it in Linux 7.1. Systems without the patch can expose the bug to an unprivileged local attacker, with no special kernel configuration beyond CONFIG_FUTEX_PI=y.
The core flaw involves a cleanup helper named remove_waiter() in kernel/locking/rtmutex.c. The helper assumed the running thread owned the waiter object that needed cleanup. Requeue-PI broke that assumption. In that path, one thread asks the kernel to move another sleeping thread’s waiter onto a target priority inheritance futex.
During a deadlock rollback, the helper cleared pi_blocked_on on the requeueing thread instead of the sleeping waiter’s task. The sleeping thread kept a pointer to a waiter object that lived on its own kernel stack. Once that syscall returned, the stack frame disappeared, and a later priority inheritance walk could follow a stale pointer.
Nebula describes the result as a stack use-after-free. The exploit chain depends on stack reuse. Nebula’s writeup says the proof of concept used PR_SET_MM_MAP because that path copies attacker-controlled auxiliary vector data into a fixed-size stack buffer near the old waiter frame.
Nebula reported two useful primitives from the forged waiter: a constrained pointer write and a constrained zero write. The team used the pointer write to redirect a kernel data pointer that later receives normal protocol traffic. The article names inet6_protos[IPPROTO_UDP] as a workable target on regular x86-64 Linux kernels.
The exploit then used the x86 CPU entry area as a small controlled kernel-address workspace. Nebula paired that with a prefetch-based address-space layout leak. In kernelCTF’s environment, where Kernel Page-Table Isolation stayed off, the team used that signal to recover the kernel image slide and physmap base.
After the constrained write redirected the IPv6 UDP protocol handler pointer into the CPU entry area, a loopback IPv6 UDP packet caused the kernel to call through attacker-shaped data. Nebula then used a short control-flow chain to change the mode bits for the core_pattern sysctl table entry.
With its mode bits changed, an unprivileged process could write a pipe-style handler path into /proc/sys/kernel/core_pattern, crash a helper process and make the kernel launch attacker-controlled code with root privileges.
Linux maintainers fixed the bug with commit 3bfdc63936dd, which makes remove_waiter() lock and clear the task stored in waiter->task instead of assuming current owns the waiter.
Kernel stack offset randomization disrupts the stack-reuse stage because the attacker can no longer predict that the later stack buffer will overlap the old waiter frame. Nebula said the exploit path faces about a 1-in-32 guess when RANDOMIZE_KSTACK_OFFSET runs.
STATIC_USERMODE_HELPER can block the specific core_pattern escalation route, though Nebula warned that similar mode-bit attacks may target other writable sysctl table entries.
Nebula reported the issue to [email protected] on April 18, 2026. Linux maintainers fixed it April 20, backported the first fix version May 4, and Google acknowledged the kernelCTF submission June 30. Nebula published its technical writeup July 7.
Security teams should check distribution advisories for CVE-2026-43499, confirm kernel backports rather than version strings alone, and treat unpatched container hosts as exposed. Container isolation does not stop a local kernel privilege escalation once an attacker can run code inside a container.