GhostLock: 15-year-old Linux kernel bug yields root and container escape

Researchers at VEGA disclosed GhostLock (CVE-2026-43499), a use-after-free in the Linux kernel’s rtmutex/futex code that has been present in every major distribution since Linux 2.6.39 shipped in 2011. The flaw was only patched in Linux 7.1 in April 2026, giving it a lifespan of more than 15 years. Exploitation needs no special privileges, capabilities, or user namespaces—only that the kernel is built with priority-inheritance futexes (CONFIG_FUTEX_PI), which is standard. The team turned it into a privilege escalation and container escape that succeeds 97% of the time, earning $92,337 from Google’s kernelCTF program.

The root cause is a classic lifecycle mistake: remove_waiter() was written assuming the currently-running thread is the one it needs to clean up. The Requeue-PI path violates that assumption, because rt_mutex_start_proxy_lock() manipulates a waiter object on behalf of a different, sleeping thread. When a deliberately constructed deadlock across three futexes and three threads forces the -EDEADLK rollback, the helper clears pi_blocked_on on the wrong task, leaving the real waiter with a dangling pointer into its own kernel stack frame after it returns to userspace. Because lockdep only checks that a pi_lock is held rather than whose, the bug went unnoticed by kernel self-checks for years.

From that stack use-after-free, the exploit sprays controlled bytes back onto the freed frame (via PR_SET_MM_MAP) to forge a fake rt_mutex_waiter, yielding a constrained arbitrary write. The chain leaks kernel ASLR with a prefetch timing side channel, overwrites the inet6_protos handler table, stages a fake protocol handler and ROP payload in the CPU entry area, and hijacks control flow through a loopback IPv6 UDP packet before flipping core_pattern to finish escalation in userspace. VEGA says a follow-up post will cover exploiting the same bug on Android, including ASLR and CFI bypasses. Unpatched systems should move to the latest LTS kernel.