{"id":182595,"date":"2026-07-10T22:54:14","date_gmt":"2026-07-10T20:54:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-raskryta-uyazvimost-ghostlock-pozvolyayushhaya-poluchit-root-dostup"},"modified":"2026-07-10T22:54:14","modified_gmt":"2026-07-10T20:54:14","slug":"v-linux-raskryta-uyazvimost-ghostlock-pozvolyayushhaya-poluchit-root-dostup","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/v-linux-raskryta-uyazvimost-ghostlock-pozvolyayushhaya-poluchit-root-dostup","title":{"rendered":"Se ha descubierto una vulnerabilidad GhostLock en Linux que permite obtener acceso root","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

<\/i><\/a>
1 <\/p>\n

Se ha descubierto una vulnerabilidad en el n\u00facleo de Linux CVE-2026-43499<\/a>, conocida de manera no oficial como GhostLock. El problema afecta al c\u00f3digo rtmutex y al mecanismo futex con herencia de prioridad, y su explotaci\u00f3n podr\u00eda permitir a un usuario local no privilegiado elevar sus derechos a root. Seg\u00fan AlmaLinux<\/a>, la vulnerabilidad tambi\u00e9n podr\u00eda ser utilizada desde un contenedor para acceder al host, si el sistema est\u00e1 funcionando con un n\u00facleo no actualizado.<\/p>\n

<\/noindex> <\/p>\n

La esencia del error est\u00e1 relacionada con la funci\u00f3n remove_waiter() en kernel\/locking\/rtmutex.c. Como se indica en la descripci\u00f3n de NVD<\/a>, al revertir el proxy-lock en el escenario futex_requeue(), la funci\u00f3n operaba con la tarea actual (current), aunque deber\u00eda haber limpiado el estado de la tarea que realmente estaba esperando el bloqueo (waiter::task). Como resultado, el estado pi_blocked_on podr\u00eda no haberse limpiado correctamente, dejando un puntero colgado y creando una condici\u00f3n para use-after-free.<\/p>\n

<\/noindex> <\/p>\n

Investigadores de Nebula Security describieron GhostLock<\/a> como un error presente en las principales distribuciones de Linux desde 2011. La discusi\u00f3n p\u00fablica sobre la vulnerabilidad ha incrementado el riesgo para servidores y entornos de contenedores: CloudLinux<\/a> advierte espec\u00edficamente que ya existe un proof-of-concept p\u00fablico para CVE-2026-43499, por lo que los administradores no deber\u00edan retrasar la actualizaci\u00f3n del n\u00facleo.<\/p>\n

<\/noindex> <\/p>\n

La correcci\u00f3n en el upstream consiste en que remove_waiter() debe usar waiter::task, y no current, en todas las operaciones relacionadas. Esto tambi\u00e9n se\u00f1ala GitHub Advisory Database<\/a>, donde se enumeran las consecuencias del error: eliminaci\u00f3n incorrecta de rbtree sin el bloqueo necesario, estado no limpio de pi_blocked_on y funcionamiento de rt_mutex_adjust_prio_chain() con la tarea equivocada.<\/p>\n

<\/noindex> <\/p>\n

Se recomienda a los usuarios de distribuciones de Linux que instalen las actualizaciones recientes del n\u00facleo desde los repositorios oficiales. La vulnerabilidad es de car\u00e1cter local, por lo que por s\u00ed misma no permite el acceso remoto, pero en servidores multipropietario, infraestructura CI, hosting y sistemas con contenedores, el riesgo es considerablemente mayor: la explotaci\u00f3n exitosa convierte el acceso privilegiado bajo ya obtenido en control total sobre el sistema.<\/p>\n

Fuente: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

1 \u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-43499, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 GhostLock. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u0434 rtmutex \u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c futex \u0441 \u043d\u0430\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0435\u0442\u0430, \u0430 \u0435\u0451 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043d\u0435\u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0430 \u0434\u043e root. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c AlmaLinux, \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0438\u0437 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0434\u043b\u044f \u0432\u044b\u0445\u043e\u0434\u0430 \u043d\u0430 \u0445\u043e\u0441\u0442, \u0435\u0441\u043b\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043d\u0430 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u043e\u043c \u044f\u0434\u0440\u0435. \u0421\u0443\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":9,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-182595","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Se ha revelado una vulnerabilidad GhostLock en Linux que permite obtener acceso root | ProHoster","description":"1 Se ha descubierto una vulnerabilidad en el n\u00facleo de Linux","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/v-linux-raskryta-uyazvimost-ghostlock-pozvolyayushhaya-poluchit-root-dostup","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c GhostLock, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root-\u0434\u043e\u0441\u0442\u0443\u043f | ProHoster","og:description":"1 \u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/v-linux-raskryta-uyazvimost-ghostlock-pozvolyayushhaya-poluchit-root-dostup","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-07-10T20:54:14+00:00","article:modified_time":"2026-07-10T20:54:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"182595","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-08-05 12:22:05","updated":"2026-08-05 12:22:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/182595","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=182595"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/182595\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=182595"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=182595"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=182595"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}