Back Feeds.4Sysops

GhostLock vulnerability enables root access and container escapes on Linux

Feeds.4Sysops •IT News • July 8, 2026

A critical use-after-free vulnerability known as GhostLock (CVE-2026-43499) has been discovered in the Linux kernel’s real-time mutex subsystem. This flaw originated in 2011 and affects nearly all mainstream distributions, allowing any locally logged-in user to gain full root privileges. The vulnerability is particularly dangerous because it requires no special permissions or unusual configurations to exploit. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical GhostLock Vulnerability Allows Root Access on Linux Systems A severe Linux kernel vulnerability, CVE-2026-43499, known as GhostLock, has been publicly disclosed by Nebula Security's VEGA team. This flaw, present since 2011, allows any logged-in user to gain full root control of affected systems in approximately five seconds, with no special permissions required. GhostLock affects nearly all mainstream Linux distributions, including Ubuntu, Debian, and Red Hat. The vulnerability exploits a logic error in the kernel's real-time mutex subsystem, specifically in the remove_waiter() function. A patch has been released, but many distributions are still vulnerable as updates are being rolled out. The flaw has been awarded a $92,337 bounty under Google's kernelCTF program due to its severity and the quality of the exploit. Organizations are urged to prioritize patching to mitigate risks associated with this vulnerability. 14 sources 73

Extracted Entities

GhostLock vulnerability enables root access and container escapes on Linux

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Tools (1)