New Exploit Targets Linux Kernel Use-After-Free Vulnerability

• •CVE-2026-43499 allows disabling SELinux via a use-after-free exploit.
• •The 'ghost-hoock' exploit operates without root access, targeting user-space processes.
• •Multiple Linux kernel versions are affected, with no patches available for older versions like 4.19.

A new exploit targeting CVE-2026-43499, a use-after-free vulnerability in the Linux kernel's futex system, has been released. The exploit, named 'ghost-hoock', allows attackers to disable SELinux by manipulating the kernel's memory management. It is particularly effective on devices running vulnerable kernel versions, including Android devices like the Samsung Galaxy A17. The exploit requires no root access and operates entirely in user space, making it accessible to a wide range of attackers. The vulnerability affects multiple kernel versions, including 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, and 7.0, while older versions like 4.19 are also at risk but lack patches. The exploit has been adapted for various kernel versions, including a specific adaptation for the 4.19 kernel. The first public proof-of-concept was released on July 15, 2026, indicating a growing threat landscape around this vulnerability.