cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Researchers Demonstrate Linux GhostLock Root Escalation and Container Escape

· Original article ↗

Summary

Nebula Security says GhostLock (CVE-2026-43499), a Linux kernel use-after-free flaw, enables local root escalation and container escape. A patch was rolled out in April; Google awarded the researchers $92,337.

Key points

  • GhostLock is tracked as CVE-2026-43499 and was introduced in Linux 2.6.39, according to the article.
  • The use-after-free occurs during task cleanup when a deadlock triggers a rollback and memory is reused while another task still holds a pointer.
  • Nebula Security says it exploited the flaw for local privilege escalation to root.
  • The researchers demonstrated a container escape in Google's kernelCTF program.
  • The flaw affects all major Linux distributions, and a patch was rolled out in April.
  • Google awarded the researchers a $92,337 bug bounty.

Article Details

Vulnerability Types
  • Use-after-free
Affected Versions
  • Linux kernel 2.6.39
Exploitation Status
unknown
Exploit Availability
public_exploit
Patch Status
available

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationNebula Security exploited the kernel vulnerability to achieve local privilege escalation to root.T1611 · Escape to HostNebula Security demonstrated that exploiting the vulnerability could enable a container escape in Google's kernelCTF program.

CVE

CVE-2026-43499Tracked as CVE-2026-43499 and referred to as GhostLock, the security defect was introduced in Linux 2.6.39 and lurked in the kernel for 15 years until a patch was rolled out in April.

Products

Linux kernelNebula Security has published technical information and exploit code targeting a Linux kernel vulnerability that affects all major distributions since 2011.

Related Articles