A vulnerability has been revealed in the Linux kernel. CVE-2026-43499, informally known as GhostLock. The issue affects the rtmutex code and the futex priority inheritance mechanism, and its exploitation may allow a local unprivileged user to elevate their rights to root. According to AlmaLinux, the vulnerability can also be exploited from a container to escape to the host if the system is running an outdated kernel.
The essence of the bug is related to the remove_waiter() function in kernel/locking/rtmutex.c. As noted in the NVD description, when reverting the proxy-lock in the futex_requeue() scenario, the function operated with the current task, although it should have cleared the state of the task that was actually waiting for the lock (waiter::task). As a result, the pi_blocked_on state might not have been cleared properly, leaving a dangling pointer and creating a prerequisite for use-after-free.
Researchers from Nebula Security described GhostLock as a bug present in major Linux distributions since 2011. The public discussion of the vulnerability increased the risk for servers and container environments: CloudLinux specifically warns that a public proof-of-concept already exists for CVE-2026-43499, so administrators should not delay updating the kernel.
The upstream fix involves ensuring that remove_waiter() uses waiter::task instead of current in all related operations. This is also indicated in GitHub Tanácsadó Adatbázis, which outlines the consequences of the bug: incorrect removal from the rbtree without the necessary lock, uncleaned pi_blocked_on state, and rt_mutex_adjust_prio_chain() operating on the wrong task.
Users of Linux distributions are advised to install fresh kernel updates from official repositories. The vulnerability is local in nature, thus it does not provide remote access by itself, but on multi-user servers, CI infrastructure, hosting environments, and container systems, the risk is significantly higher: successful exploitation turns already acquired low-privileged access into full control over the system.
Forrás: linux.org.ru
