15-Year-Old Ghost Lock Flaw Enables Root and Container Escape on Most Linux Distros
Summary: Researchers at Nebula Security disclosed GhostLock (CVE-2026-43499), a use-after-free flaw in Linux kernel futex priority inheritance code that has shipped by default in mainstream distributions since 2011 and lets any logged-in local user gain root; Nebula built a working exploit that it reports is 97% reliable and also escapes containers, and Google awarded the team $92,337 through kernelCTF. The flaw was fixed in April (commit 3bfdc63936dd), scores 7.8 out of 10, and Nebula has published working exploit code, though no in-the-wild exploitation is known.
Key Takeaway: Nebula chained GhostLock with a Firefox sandbox escape (CVE-2026-10702) into a full IonStack exploit demonstrated against Firefox on Android, turning a local-only bug into remote compromise from a single tap on a malicious link. Ubuntu still listed 24.04, 22.04, and 20.04 LTS as vulnerable or in progress as of early July, and the original fix introduced a separate crash bug (CVE-2026-53166), so early patched builds may not carry the final version.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2026-10702CVE-2026-31431CVE-2026-43499CVE-2026-46242CVE-2026-53166
- Related
- New Cyber Risks ·