Information about a vulnerability (CVE-2026-43499) in the Linux kernel, code-named GhostLock, has been revealed. This vulnerability allows an unprivileged local user to gain root privileges on the system and escape from isolated containers. When combined with other browser vulnerabilities, this issue can be exploited for remote code execution with root privileges when a specially crafted web page is opened. The problem has been present since Linux kernel version 2.6.39 (2011).
It is claimed that the vulnerability can be exploited across all distributions released in the past 15 years. A working exploit exists, for which its creators received a $92,337 bounty from Google for successfully elevating privileges in a KernelCTF (Capture the Flag) environment, which includes additional patches to block common exploit methods. The success rate of the exploit is estimated at 97%. The vulnerability was discovered using the AI tool VEGA.
The patch fixing this issue was accepted into the kernel code base on April 21 and has been included in the releases of kernel versions 7.1.0, 6.18.36, 6.12.95, 6.6.144, and 6.1.177. The status of vulnerability remediation in distributions can be assessed on these pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, AlmaLinux, Gentoo, Arch, Fedora. There are no workarounds to block the issue.
The vulnerability exists in the implementation of futex locks and is caused by a use-after-free memory access that occurs during priority inheritance, which prevents priority inversion (a high-priority task being blocked due to waiting for a resource held by a low-priority task). In situations where the lock acquisition fails, the kernel rolls back the state and calls the cleanup function. Under certain circumstances, the cleanup function is called at an inappropriate time and releases the data structure of another task, leading to a dangling pointer that refers to already freed memory.
Exploitation of the vulnerability involves creating conditions for a dangling pointer to occur, using only the available system calls for thread management, implementing a primitive for writing using the dangling pointer to an arbitrary area of kernel memory, and utilizing this primitive to substitute a jump in the kernel function table to intercept the control flow.
In the proposed exploit, the pointer in the inet6_protos[IPPROTO_UDP] function table is overwritten, after which a UDP packet is sent to the loopback interface via IPv6. When processed, it calls the handler, the pointer to which was replaced in the previous step. To gain root access, the control code of the exploit writes its handler to /proc/sys/kernel/core_pattern, invoked with root privileges upon process crashes.
In addition to the noted issue, several other dangerous vulnerabilities have been identified in the Linux kernel:
- Januscape (CVE-2026-53359) — a use-after-free memory access in hypervisor components executed on the virtual machine side to emulate the Memory Management Unit (MMU) and translate addresses between the host and guest systems. This vulnerability manifests on systems with Intel and AMD processors and allows accessing the host environment with root privileges in the presence of root access in the guest system. KVMA prototype exploit that corrupts the content of the data structures on the host system side used for address translation is available for download. The published exploit causes the host system to crash, but according to the researcher who uncovered the issue, they have also created an exploit for executing code in the host environment with root privileges, which they are not yet publishing to allow time for updates to be applied.
The issue is caused by an error made 16 years ago and has been resolved in updates 7.1.3, 6.18.38, 6.12.95, 6.6.144, and 6.1.177. The status of vulnerability fixes in various distributions can be assessed on these pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, Fedora. The researcher was awarded $250,000 by Google for identifying the vulnerability as part of the kvmCTF initiative.
To exit the guest system onto
To exit the guest system on servers An ARM64 processor vulnerability, identified by the same researcher, is ITScape (CVE-2026-46316), caused by a race condition in the vGIC-ITS (Interrupt Translation Service) emulation code in KVM. A prototype exploit for this issue has also been published.
- Bad Epoll (CVE-2026-46242) is a race condition leading to access to memory after it has been freed in the epoll subsystem of the kernel. This vulnerability allows a local unprivileged user to execute code with root privileges. Notably, it enables attacks on not only traditional Linux distributions but also firmware based on the Android platform, and it is not blocked by sandbox isolation in Chrome. A working exploit was demonstrated at the kernelCTF competition, with Google paying the author $71,337. The exploit's reliability is estimated at 99%.
The issue manifests starting from Linux kernel 6.4 (2023). The kernel developers were informed about the problem on February 17, but a fix was only developed after several unsuccessful attempts on April 24. The problem has been addressed in kernels 6.18.24, 6.12.83, and 6.6.136. The status of vulnerability fixes in the distributions can be evaluated on these pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, Fedora.
- CVE-2026-46215 involves memory access after it has been freed in the ioctl DRM_IOCTL_GEM_CHANGE_HANDLE implementation in the DRM (Direct Rendering Manager) subsystem. A local user with access to the /dev/dri/renderD* devices (the systemd-logind service grants access to all users when starting a graphical session in all major distributions) can gain root privileges on the system. An exploit exists. The problem appears starting from kernel 6.18 and was fixed in the updates 7.0.9 and 6.18.32. The status of vulnerability fixes in the distributions can be evaluated on these pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, Fedora.
Source: opennet.ru
