TLDR Tech / InfoSec
15-Year-Old GhostLock Linux Kernel Vulnerability Enables Root Access and Container Escape
GhostLock (CVE-2026-43499) is a stack-based use-after-free in the kernel's rtmutex priority-inheritance path where remove_waiter() clears the wrong task's pi_blocked_on field during FUTEX_CMP_REQUEUE_PI operations, leaving a dangling pointer to freed stack memory that attackers reclaim to achieve near-arbitrary kernel writes. The chain bypasses KASLR with prefetch-timing attacks, hijacks the inet6_protos IPv6 handler for execution control, and flips core_pattern permissions (“DirtyMode”) for root, reaching 97% reliability and earning over $92,000 in Google's kernelCTF. It needs no elevated privileges or namespaces and enables container escape to the host. Teams should update immediately and layer RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER as defense-in-depth rather than substitutes for the patch.
Read the full story