# GhostLock: A 15-Year-Old Linux Security Vulnerability

A critical security flaw affecting all Linux distributions has been discovered.

- **Source:** [Hacker News (news.ycombinator.com)](https://brifing.si/source/13c923cd-6d99-442b-9b8b-1181f4d8cd91)
- **Published:** 2026-07-08
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://nebusec.ai/research/ionstack-part-2/>
- **On Brifing:** https://brifing.si/s/dfe8ac8d-0f48-4aff-a373-c0af05ee3414

## What is GhostLock?

GhostLock (CVE-2026-43499) is a kernel vulnerability present in all major Linux distributions since 2011. It can be triggered without special kernel configuration or privileges. This flaw allows 97% stable privilege escalation and container escape.

## Discovery and Reward

Discovered by VEGA researchers, GhostLock earned a $92,337 bounty from Google's kernelCTF program. The flaw affects all Linux versions from 2.6.39 to 7.1 and remained undetected for 15 years.

## Affected Systems

GhostLock impacts all unpatched Linux distributions. Systems with CONFIG_FUTEX_PI=y configuration are particularly at risk. This vulnerability doesn't require user namespaces or special privileges, threatening a wide user base.

## Technical Details

GhostLock arises from a flaw in the rtmutex structure. The remove_waiter() function cleans the wrong task on the proxy path, causing a stack-UAF (Use-After-Free) vulnerability that grants kernel memory access.

## Exploitation Scenario

An attacker can exploit this flaw to write a pointer to kernel stack memory and hijack a function table. This leads to control flow hijacking and eventual root access.

## Root Cause Analysis

The issue stems from remove_waiter() cleaning the wrong task in Requeue-PI scenarios. Originally designed for a single use case, its misuse in different contexts created this security hole.

## Triggering the Vulnerability

Triggering the EDEADLK rollback requires three futex words and three threads. A PI dependency cycle involving waiter, owner, and main threads must be established to exploit the flaw.

## Triggering Stack-UAF

After setting up the three-futex cycle, the waiter task remains in userspace with pi_blocked_on dangling into its old FUTEX_WAIT_REQUEUE_PI frame. This allows writing controlled bytes at the same stack depth.

## Impact of the Vulnerability

GhostLock enables attackers to access kernel memory and gain root privileges. This can lead to severe consequences like container escape and access to other system resources.

## Solution and Patch

The flaw was fixed in Linux 7.1. Affected systems should upgrade to the latest LTS version. The patch resolves the issue by locking waiter->task->pi_lock and clearing waiter->task->pi_blocked_on.

## Lockdep's Role

Lockdep only checks if a pi_lock is held but not whose it is. This makes detecting flaws like GhostLock difficult, allowing vulnerabilities to remain unnoticed for extended periods.

## Conclusion and Recommendations

GhostLock highlights a long-standing critical vulnerability in the Linux ecosystem. System administrators should apply the latest patches to secure their systems. Such flaws necessitate revisiting kernel developers' code review processes.

## Sources covering this story

- https://nebusec.ai/research/ionstack-part-2/ — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._