Nebula Security has published technical information and exploit code targeting a Linux kernel vulnerability that affects all major distributions since 2011.
Tracked as CVE-2026-43499 and referred to as GhostLock, the security defect was introduced in Linux 2.6.39 and lurked in the kernel for 15 years until a patch was rolled out in April.
GhostLock is a use-after-free issue introduced with a helper function designed to clean up after a task has been closed, as part of the kernel’s system of prioritizing urgent tasks.
Normally, the cleanup function would clear the current task. Due to the security defect, when a deadlock is encountered and a rollback occurs, the function clears the memory and reuses it while a pointer to it exists in another task.
The issue exists because the function assumes that the current task is the one that needs to be cleared up. However, when a requeue is requested, the function cleans up on behalf of a sleeping thread instead of the current one.
Nebula Security says it was able to exploit the vulnerability to control the inadvertently freed memory and achieve local privilege escalation to root.
It also demonstrated that the security defect could be exploited for a container escape in Google’s kernelCTF program and received a $92,337 bug bounty reward.
GhostLock is the latest in a series of Linux kernel flaws that have been publicly disclosed over the past months. The list also includes Januscape, Bad Epoll, DirtyClone, CIFSwitch, DirtyDecrypt (aka DirtyCBC), Fragnesia, and Dirty Frag.
Related: Microsoft Patches Defender ‘RoguePlanet’ Vulnerability
Related: Chrome 150 Update Patches 27 Vulnerabilities
Related: Unpatched Backdoor in Tenda Firmware Grants Admin Access to Devices
Related: CISA Urges Immediate Patching of Exploited ColdFusion, Langflow, Joomla Flaws
