CVE-2026-43499 (GhostLock): Linux Kernel UAF Flaw
CVE-2026-43499 (GhostLock): a CVSS 7.8 use-after-free in the Linux kernel rtmutex, patched in 2026.
★ 4.0 / 5 iKeep scoreCVE-2026-43499, tracked as “GhostLock,” is a high-severity use-after-free (UAF) vulnerability in the Linux kernel’s rtmutex locking subsystem (remove_waiter()). It lets an unprivileged local attacker escalate privileges or crash the system, carries a CVSS 3.1 base score of 7.8, and has affected major Linux distributions since kernel 2.6.39 (2011).
Screenshots
Quick facts
Overview
GhostLock (CVE-2026-43499) is a use-after-free vulnerability in the Linux kernel’s rtmutex (real-time mutex) code, specifically the remove_waiter() routine used on the slow-lock and proxy-lock rollback paths. Because remove_waiter() operated on the current task instead of waiter::task, it left a dangling pointer that a local, unprivileged attacker can abuse to escalate privileges or trigger a denial of service. The flaw has existed in every major distribution since kernel 2.6.39 (2011), scores CVSS 3.1 7.8 (High), and is fixed in kernel 6.6.140+, 6.12.86+, 6.18.27+, 7.0.4+ and 7.1. The nebusec.ai (VEGA) writeup provides the full technical exploitation analysis.
CVE-2026-43499 (GhostLock) vulnerability details
The bug lives in the Linux kernel’s rtmutex (real-time mutex / PI-futex) subsystem. remove_waiter() is used by the slow-lock paths and for proxy-lock rollback in rt_mutex_start_proxy_lock() when called from futex_requeue(). In that rollback case waiter::task is not the current task, yet remove_waiter() dequeued using current — so the rbtree dequeue ran without holding waiter::task::pi_lock, the waiter task’s pi_blocked_on state was never cleared, and rt_mutex_adjust_prio_chain() operated on the wrong top-priority waiter. The result is a dangling pointer primed for a use-after-free.
Because the affected code paths ship in all standard kernel builds, exploitation does not require special kernel configuration. A local, unprivileged attacker can leverage the UAF to escalate privileges or cause a denial of service; researchers additionally demonstrated container-escape potential. Environments that do not use real-time scheduling or Priority Inheritance futexes have reduced exposure. The upstream fix uses waiter::task instead of current across all remove_waiter() operations.
Mitigation is to update to a patched kernel and reboot. Fixed versions are 6.6.140+, 6.12.86+, 6.18.27+, 7.0.4+, and 7.1. Major vendors have released updated kernel packages (e.g. Red Hat RHEL 6–10, Amazon Linux 2 and 2023), so applying your distribution’s current kernel errata closes the flaw. GhostLock is tracked alongside the related kernel locking flaw CVE-2026-53166.
Affected versions
- Linux kernel 2.6.39 – 6.6.139
- Linux kernel 6.12 – 6.12.85
- Linux kernel 6.18 – 6.18.26
- Linux kernel 7.0 – 7.0.3
- All builds prior to 7.1-rc1
Fixed versions
- Linux kernel 6.6.140 or later
- Linux kernel 6.12.86 or later
- Linux kernel 6.18.27 or later
- Linux kernel 7.0.4 or later
- Linux kernel 7.1 or later
Sources: NVD (NIST), OSV.dev, Red Hat RHSB-2026-010, VEGA / nebusec research
Getting started with IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
- Read vulnerability detailsReview the technical writeup on the official URL to understand GhostLock's exploit mechanism.
- Check Linux kernel versionVerify if your system runs an affected Linux kernel version (distros since 2011).
- Apply patchesMonitor for and apply official kernel updates from your distribution's security team.
- Test exploit mitigationUse provided PoC (if available) to verify vulnerability status after patching.
Pricing
| Plan | Price | Note |
|---|---|---|
| Research paper | Free | — |
💡 Indicative pricing — check the official rates at nebusec.ai · Updated 7/16/2026
Original pricing screenshotKey features
- Unprivileged local privilege escalation
- Container escape capability
- Affects all major Linux distributions since 2011
- 97% stable exploit success rate
- No special kernel configuration required
- Detailed technical analysis provided
Pros
- Comprehensive technical breakdown
- High impact vulnerability
- Clear demonstration of exploit
Cons
- Highly technical content
- Limited to Linux kernel security
Use cases
- Security researchers analyzing kernel vulnerabilities
- System administrators assessing risk
- Developers working on Linux kernel security
The verdict
Essential reading for security professionals dealing with Linux systems, providing deep technical insights into a long-standing vulnerability with serious implications.
✓ Who should use it
Security researchers and system administrators who need to understand and mitigate this critical Linux kernel vulnerability.
✕ Who should skip it
General users without technical security background or those not working with Linux systems.
Categories
Great for
Featured in
Frequently asked questions
What is CVE-2026-43499?
CVE-2026-43499 (“GhostLock”) is a use-after-free vulnerability in the Linux kernel’s rtmutex locking code. In remove_waiter() the kernel operated on the current task instead of waiter::task, leaving a dangling pointer that enables local privilege escalation or denial of service.
What is the CVSS score of CVE-2026-43499?
CVE-2026-43499 has a CVSS 3.1 base score of 7.8 (High), with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — a local, low-complexity attack requiring low privileges and no user interaction, with high impact on confidentiality, integrity and availability.
Which Linux kernel versions are affected by CVE-2026-43499?
Affected kernels include 2.6.39 through 6.6.139, 6.12 through 6.12.85, 6.18 through 6.18.26, 7.0 through 7.0.3, and builds before 7.1-rc1. The affected rtmutex code paths are present in all standard kernel builds across major distributions.
How do I fix or patch CVE-2026-43499?
Update to a fixed Linux kernel: 6.6.140 or later, 6.12.86 or later, 6.18.27 or later, 7.0.4 or later, or 7.1. Distribution vendors (Red Hat, Amazon Linux, Ubuntu, SUSE) have shipped patched kernel packages — apply your distro’s latest kernel update and reboot.
Is CVE-2026-43499 being exploited in the wild?
As of publication there is no confirmed widespread in-the-wild exploitation, but the flaw is local-privilege-escalation class and researchers (VEGA/nebusec) reported a highly reliable exploit, so vendors are expediting fixes. Treat it as high priority and patch promptly.
Is IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years free?
IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years is free to use.
What is IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years best for?
Cybersecurity professionals and Linux kernel developers
Does IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years have an API?
No, IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years does not offer a public API.
Can I self-host IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years?
No, IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years is not self-hostable.
Who should use IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years?
Security researchers and system administrators who need to understand and mitigate this critical Linux kernel vulnerability.
Reviews 5.0 ★ · 1 review
GhostLock (CVE-2026-43499) is a game-changer for cybersecurity professionals and Linux sysadmins. As someone who’s tracked kernel vulnerabilities for years, I’m impressed by VEGA’s deep dive into this exploit—it’s rare to see such a well-documented breakdown of a privilege escalation flaw affecting over a decade of Linux distributions. The IonStack writeup doesn’t just highlight the bug; it delivers actionable insights for hardening systems against container escapes, making it essential reading for DevSecOps teams and cloud security specialists. What stands out is NebuSec’s clear explanation of the exploit chain, complete with mitigation strategies. This isn’t just theoretical—it’s a must-read for anyone responsible for Linux infrastructure security, especially in multi-tenant environments where container breakout risks are critical.
No reviews yet. Be the first to review IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years.
Write a review
Related tools
