15-Year-Old GhostLock Linux Kernel Flaw Enables Root Access and Container Escape

Researchers at Nebula Security have disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel vulnerability that allows any logged-in user to gain full root control and escape containers on unpatched systems. The flaw, present in nearly all mainstream Linux distributions since 2011, requires no special permissions, unusual settings, or network access—only ordinary threading calls from a local program.

Nebula Security developed a working exploit with 97% reliability, earning a $92,337 bounty from Google’s kernelCTF program. While no active exploitation has been observed in the wild, the public release of exploit code makes patching urgent.

The vulnerability is a use-after-free bug in the kernel’s futex priority inheritance mechanism, introduced in 2011. It was fixed in April 2026 (commit 3bfdc63936dd), but distributions are still rolling out patches. The initial fix introduced a separate crash bug (CVE-2026-53166), so users should install the latest patched kernel version rather than the first available build.

GhostLock is part of a chain called IonStack, combining with a Firefox sandbox escape (CVE-2026-10702) to enable remote compromise from a single malicious link. Nebula plans to publish a full write-up of the Android exploit chain.

Mitigations like RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER can make exploitation harder but are not complete fixes. Priority should be given to patching shared and multi-tenant systems, cloud servers, containers, and CI runners.