GhostLock is bad. Really bad. It’s a 15-year-old Linux kernel vulnerability that lets any logged-in user take full root control of an unpatched machine. No special permissions needed. No unusual settings. No network access. Just standard threading calls from any local program.
Nebula Security disclosed the flaw — tracked as CVE-2026-43499 — and turned it into a working exploit that’s 97% reliable. It also escapes containers. Google paid the team $92,337 through its kernelCTF bounty program.
The bug has been shipping by default in every mainstream Linux distribution since 2011. That’s a lot of machines. A lot.
Here’s how it works: the kernel has a system for managing urgent tasks. Part of that system is a cleanup step that runs after a task stops waiting. Normally, fine. But in one rare edge case — when a lock operation dead-ends and has to back out — the cleanup runs at the wrong time and wipes the wrong task’s record. The kernel ends up holding a pointer to memory it already freed and reused. Classic use-after-free. Nebula chained a few steps to turn that small mistake into full root code execution. On their test machine, it took about five seconds.
The fix went into the kernel in April. The commit ID is 3bfdc63936dd. But it’s not straightforward — the original fix introduced a separate crash bug (CVE-2026-53166), and the final cleanup was still settling upstream in early July. Not all distro patches are final yet. Ubuntu had patched its newest release and some cloud kernels, but still listed 24.04, 22.04, and 20.04 LTS as vulnerable or in progress as of early July.
No active exploitation known — yet. But Nebula published working exploit code on GitHub. Anyone can run it now. Patch priority: shared and multi-tenant machines first, then cloud servers, containers, and CI runners.
