A vulnerability has been discovered in the Linux kernel CVE-2026-43499, informally referred to as GhostLock. The issue involves the rtmutex code and the futex mechanism with priority inheritance, and its exploitation could allow a local unprivileged user to escalate their privileges to root. According to AlmaLinux, the vulnerability can also be exploited from a container to access the host if the system is running on an outdated kernel.
The root of the error is linked to the remove_waiter() function in kernel/locking/rtmutex.c. As stated in the NVD description, during the rollback of proxy-lock in the futex_requeue() scenario, the function operated on the current task, whereas it should have cleared the state of the task that was actually waiting for the lock (waiter::task). Consequently, the pi_blocked_on state might not have been cleared correctly, leaving a dangling pointer and creating conditions for a use-after-free.
Researchers from Nebula Security described GhostLock as an error present in major Linux distributions since 2011. Public discussion of the vulnerability has heightened the risk to servers and container environments: CloudLinux specifically warns that a public proof-of-concept already exists for CVE-2026-43499, so administrators should not delay updating the kernel.
The upstream fix is that remove_waiter() must utilize waiter::task instead of current in all related operations. This is also indicated by the GitHub Advisory Database, which lists the consequences of the error: incorrect removal from rbtree without the necessary locking, uncleared pi_blocked_on state, and rt_mutex_adjust_prio_chain() operating on the wrong task.
Users of Linux distributions are advised to install the latest kernel updates from official repositories. The vulnerability is local in nature, so it does not allow remote access by itself, but on multi-user servers, CI infrastructures, hosting services, and systems with containers, the risk is significantly higher: successful exploitation can turn already acquired low-privileged access into full control over the system.
Source: linux.org.ru
