Skip to content

Linux GhostLock CVE-2026-43499 container escape

Summary

GhostLock is CVE-2026-43499, a Linux kernel rtmutex / priority-inheritance waiter use-after-free disclosed by Nebula Security in July 2026. Nebula says the bug was introduced in Linux 2.6.39-era rtmutex changes, remained reachable for roughly 15 years, requires only normal local threading syscalls with CONFIG_FUTEX_PI=y, and was fixed upstream in Linux 7.1 via the April 2026 remove_waiter() fix.

The public writeup is high-signal because it includes a working local-root exploit path, claims roughly 97% stable privilege escalation in testing, and demonstrates container escape. Nebula also published exploit code and says Google paid a kernelCTF reward, so defenders should treat unpatched multi-user Linux, container hosts, CI runners, developer workstations, browser-sandbox escape chains, and shared compute as priority patch-and-reboot targets even without known in-the-wild exploitation.

Tags

Why this matters

  • This is a post-compromise root path for any vulnerable host where an attacker can run local code: shell access, compromised web apps, container workloads, CI jobs, desktop malware, browser renderer escapes, or malicious developer dependencies.
  • The container-escape claim raises the blast radius from a single container workload to the container host and neighboring secrets, credentials, mounted volumes, and orchestrator identities.
  • The exploit does not depend on unusual kernel features beyond CONFIG_FUTEX_PI=y; Nebula characterizes mainstream distributions without the patch as affected.
  • Public exploit code changes the defender timeline. Even if there is no confirmed exploitation today, internet-exposed services that grant any local code execution path become plausible GhostLock staging points.
  • Kernel updates must be validated against the running kernel. Installing patched packages without rebooting container hosts, CI runners, Kubernetes nodes, or developer desktops leaves the primitive available.

Public vulnerability detail

  • Name: GhostLock.
  • CVE: CVE-2026-43499.
  • Component: Linux kernel rtmutex / priority-inheritance (PI) waiter handling, with CONFIG_FUTEX_PI=y called out as the key configuration prerequisite.
  • Affected range called out by Nebula: v2.6.39-rc1 through v7.1-rc1 before the fix, subject to distribution backports.
  • Fix called out by Nebula: upstream commit 3bfdc63936dd titled rtmutex: Use waiter::task instead of current in remove_waiter().
  • Bug class: stack use-after-free / dangling kernel pointer to waiter stack memory leading to a controlled write and function-table hijack.
  • Impact: unprivileged local privilege escalation to root and container escape.
  • Exploit status: public exploit repository; Nebula reports approximately 97% exploit stability and a Google kernelCTF reward.
  • Wild exploitation: no public evidence of in-the-wild exploitation was cited in the checked public reporting at scan time.

Defender heuristics

  1. Prioritize kernel patching and reboot validation for container hosts, Kubernetes nodes, CI runners, shared bastions, VDI fleets, developer workstations, jump boxes, browser-sandbox workloads, and any server where untrusted code can execute.
  2. Check the running kernel and vendor backport status, not only package inventory. Capture uname -a, kernel package versions, reboot timestamps, and node drain/restart evidence.
  3. If patching is delayed, reduce local-code execution exposure: isolate untrusted containers, disable or quarantine risky CI runners, restrict shell access, harden browser isolation, and move high-risk workloads off shared hosts.
  4. Review container runtime and Kubernetes events for suspicious host-bound breakouts after local-code execution in a container: unexpected privileged processes, host namespace access, altered mounts, credential reads, kubelet interaction, or root shells spawned from containerized workloads.
  5. Hunt for GhostLock PoC artifacts, unexpected futex/priority-inheritance stress binaries, kernel warnings or crashes near rtmutex / futex paths, and sudden UID 0 transitions from low-privilege users or container processes.
  6. Treat confirmed exploitation as host-root compromise. Rotate secrets available to the compromised principal and host, including container registry credentials, CI tokens, cloud instance credentials, Kubernetes service-account tokens, SSH keys, package-registry tokens, and workload identity material.

Sources

  • Nebula Security: https://nebusec.ai/research/ionstack-part-2/
  • Nebula Security public exploit repository: https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499
  • NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-43499
  • The Hacker News: https://thehackernews.com/2026/07/15-year-old-ghostlock-flaw-enables-root.html