GhostLock (CVE-2026-43499): The 15-Year-Old Kernel Bug That Hands Anyone Root
A working proof-of-concept for CVE-2026-43499, nicknamed GhostLock, went public on July 7, 2026. It hands any unprivileged local user a root shell in about five seconds, and it works from inside a container to escape to the host. If you run Linux servers — shared hosting, VPS, or bare metal — this is the one to patch before anything else this week. What GhostLock is The bug lives in kernel/locking/rtmutex.c, on the futex priority-inheritance (PI) path. When the kernel handles a FUTEX_CMP_REQUEUE_PI requeue and detects a deadlock cycle, it rolls back with -EDEADLK by calling remove_waiter(). The problem: that helper clears pi_blocked_on on the wrong thread — not the sleeping thread it should be cleaning up, but the currently running task. That leaves a live thread holding a dangling pointer into already-freed kernel stack memory. Stack use-after-free. ...