GhostLock Linux Kernel Flaw Enables Root Access and Container Escape

Summary

Researchers disclosed GhostLock (CVE-2026-43499), a Linux kernel flaw that can let a local user gain root and escape containers. Nebula says its exploit is 97% reliable and has published code; no in-the-wild exploitation is known. Install fully updated kernels.

Key points

GhostLock is a Linux kernel use-after-free flaw present since 2011; an unprivileged local user can exploit unpatched systems for root access.
Nebula Security says its exploit was 97% reliable in testing, can escape containers, and has published working code.
The flaw stems from a lock-operation cleanup race that can leave the kernel using a stale pointer; exploitation requires no network access.
The flaw was fixed in April, but distributions are rolling out updates unevenly. The article advises installing the current kernel package, since the initial fix introduced a separate crash issue, CVE-2026-53166.
The article reports no known exploitation in the wild and says there is no complete workaround; two build options make exploitation harder but do not fix the flaw.
Nebula says GhostLock completes its IonStack chain with Firefox flaw CVE-2026-10702, demonstrating a path from a malicious link to root on Android.

Article Details

Vulnerability Types: Use-after-free
Local privilege escalation
Severity: High (CVSS 7.8/10)
Exploitation Status: not_reported
Exploit Availability: public_exploit
Patch Status: available
Workarounds: RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER make exploitation harder, but are mitigations rather than fixes.