Definition
GhostLock (CVE-2026-43499) is a stack-based use-after-free vulnerability in the Linux kernel rtmutex priority-inheritance futex cleanup path. An unprivileged local attacker can achieve root privilege escalation (~97% success in research) and container escape.
Key Points
- Discovered by: Nebula Security VEGA automated analysis tool
- Affected range: Linux v2.6.39-rc1 through v7.1-rc1 (introduced 2011, 15 years latent)
- Requirement: CONFIG_FUTEX_PI=y (enabled on virtually all distro kernels)
- Root cause:
remove_waiter()assumes current task owns waiter; requeue path cleans wrong task, leaving danglingrt_mutex_waiterpointer - Fix: commit 3bfdc63936dd in Linux 7.1; backported to AlmaLinux, CloudLinux, and other distros (July 2026)
- CVSS: 7.8 High — local attack vector, low complexity, low privileges, no user interaction
- Bounty: $92,337 Google kernelCTF reward
- Part of: 2026 Linux kernel vulnerability wave alongside Januscape, Bad Epoll, dirtyclone, DirtyFrag