Researchers at Nebula Security have disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel use-after-free vulnerability that lets any logged-in local user seize full root control of an unpatched machine and escape most container sandboxes.
Present In Every Major Distro Since 2011
The bug lives in the kernel's real-time mutex (rtmutex) subsystem, specifically the priority-inheritance rollback in remove_waiter(), and has shipped by default in every mainstream Linux distribution since kernel 2.6.39 in 2011. Triggering it requires no special permissions, no unusual settings and no network access; ordinary threading syscalls from any local program are enough.
97% Reliable Exploit, $92K Google Bounty
Nebula turned the flaw into a working root exploit that ran successfully 97% of the time on test machines and also breaks out of Linux containers. Google awarded the team $92,337 through its kernelCTF bug-bounty programme. Nebula found the bug with VEGA, its AI-driven vulnerability-research agent, mirroring a trend of AI-assisted tools surfacing decade-old flaws that survived countless human reviews.
Second Half Of Nebula's IonStack Chain
GhostLock is the second stage of a chain Nebula calls IonStack. The first half, CVE-2026-10702, is a Firefox flaw that runs code inside the browser and escapes its sandbox; GhostLock carries the attacker the rest of the way to root. Nebula has already demonstrated the full remote chain against Firefox on Android from a single malicious link.
Patch Now, Not Just The First Fix
The flaw was fixed in Linux 7.1 (commit 3bfdc63936dd) in April 2026, but the original fix introduced a separate crash bug (CVE-2026-53166), so Nebula urges administrators to install their distribution's current kernel rather than the first patched build. Ubuntu 24.04, 22.04 and 20.04 LTS were still listed as vulnerable or in progress in early July.
GhostLock joins a busy year for Linux privilege-escalation research; recent disclosures include Microsoft's record 622-CVE July Patch Tuesday and the AnyDesk CVE-2026-15682 zero-day, underscoring the pace at which AI-assisted bug-hunting is reshaping the vulnerability pipeline.
Reporting based on coverage from The Hacker News and Nebula Security.