GhostLock: A 15-Year-Old Linux Security Vulnerability
A critical security flaw affecting all Linux distributions has been discovered.
1What is GhostLock?
GhostLock (CVE-2026-43499) is a kernel vulnerability present in all major Linux distributions since 2011. It can be triggered without special kernel configuration or privileges. This flaw allows 97% stable privilege escalation and container escape.
2Discovery and Reward
Discovered by VEGA researchers, GhostLock earned a $92,337 bounty from Google's kernelCTF program. The flaw affects all Linux versions from 2.6.39 to 7.1 and remained undetected for 15 years.
3Affected Systems
GhostLock impacts all unpatched Linux distributions. Systems with CONFIG_FUTEX_PI=y configuration are particularly at risk. This vulnerability doesn't require user namespaces or special privileges, threatening a wide user base.
4Technical Details
GhostLock arises from a flaw in the rtmutex structure. The remove_waiter() function cleans the wrong task on the proxy path, causing a stack-UAF (Use-After-Free) vulnerability that grants kernel memory access.
5Exploitation Scenario
An attacker can exploit this flaw to write a pointer to kernel stack memory and hijack a function table. This leads to control flow hijacking and eventual root access.
6Root Cause Analysis
The issue stems from remove_waiter() cleaning the wrong task in Requeue-PI scenarios. Originally designed for a single use case, its misuse in different contexts created this security hole.
7Triggering the Vulnerability
Triggering the EDEADLK rollback requires three futex words and three threads. A PI dependency cycle involving waiter, owner, and main threads must be established to exploit the flaw.
8Triggering Stack-UAF
After setting up the three-futex cycle, the waiter task remains in userspace with pi_blocked_on dangling into its old FUTEX_WAIT_REQUEUE_PI frame. This allows writing controlled bytes at the same stack depth.
9Impact of the Vulnerability
GhostLock enables attackers to access kernel memory and gain root privileges. This can lead to severe consequences like container escape and access to other system resources.
10Solution and Patch
The flaw was fixed in Linux 7.1. Affected systems should upgrade to the latest LTS version. The patch resolves the issue by locking waiter->task->pi_lock and clearing waiter->task->pi_blocked_on.
11Lockdep's Role
Lockdep only checks if a pi_lock is held but not whose it is. This makes detecting flaws like GhostLock difficult, allowing vulnerabilities to remain unnoticed for extended periods.
12Conclusion and Recommendations
GhostLock highlights a long-standing critical vulnerability in the Linux ecosystem. System administrators should apply the latest patches to secure their systems. Such flaws necessitate revisiting kernel developers' code review processes.
Original article: Hacker News (news.ycombinator.com) — GhostLock: 15 Yıllık Linux Güvenlik Açığı