https://blog.kalfaoglu.net/tags/futex/Recent content in Futex on kalfaoglu.netHugoenThu, 16 Jul 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-07-16-ghostlock-cve-2026-43499-kernel-lpe-en/Thu, 16 Jul 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-07-16-ghostlock-cve-2026-43499-kernel-lpe-en/<p>A working proof-of-concept for <a href="https://www.cve.org/CVERecord?id=CVE-2026-43499">CVE-2026-43499</a>, nicknamed GhostLock, went public on July 7, 2026. It hands any unprivileged local user a root shell in about five seconds, and it works from inside a container to escape to the host. If you run Linux servers — shared hosting, VPS, or bare metal — this is the one to patch before anything else this week.</p> <h2 id="what-ghostlock-is">What GhostLock is</h2> <p>The bug lives in <code>kernel/locking/rtmutex.c</code>, on the futex priority-inheritance (PI) path. When the kernel handles a <code>FUTEX_CMP_REQUEUE_PI</code> requeue and detects a deadlock cycle, it rolls back with <code>-EDEADLK</code> by calling <code>remove_waiter()</code>. The problem: that helper clears <code>pi_blocked_on</code> on the <em>wrong</em> thread — not the sleeping thread it should be cleaning up, but the currently running task. That leaves a live thread holding a dangling pointer into already-freed kernel stack memory. Stack use-after-free.</p>