GhostLock turns a fifteen-year-old rtmutex use-after-free into root in five seconds
CVE-2026-43499, dubbed GhostLock, is a use-after-free in rtmutex priority-inheritance code that has shipped since kernel 2.6.39 and is reachable by any unprivileged local process. The fix landed in 7.1, but two months after the public PoC, blind spots like RHEL 9 kernel-rt remain: check your version and block PI futexes in the meantime.
July 7, 2026. Nebula Security publishes its analysis of GhostLock (CVE-2026-43499), a use-after-free in the rtmutex priority-inheritance code. July 8, 2026. A public proof-of-concept lands a root shell in five seconds, with 97% reliability. September 2026. Red Hat is still expediting fixes in bulletin RHSB-2026-010. Why it matters: the bug has slept in the kernel since 2011, requires no privilege, and escapes a container to the host.
The bug: a use-after-free on kernel stack memory
The flaw lives in kernel/locking/rtmutex.c, in remove_waiter(), the helper that unwinds a lock request when an operation must be rolled back. The routine was written on the assumption that the thread doing the cleanup always owns the request it is tearing down.
That assumption breaks on the FUTEX_CMP_REQUEUE_PI path. During a priority-inheritance requeue, the kernel can detect a deadlock cycle and call remove_waiter() in a context where the assumption no longer holds: the lock belongs to a different task. The function then clears pi_blocked_on on the wrong task and leaves a dangling pointer into already-freed kernel stack memory — a textbook use-after-free.
Exploitation reclaims the freed region with a carefully shaped allocation, plants a forged kernel structure in it, and dereferences the dangling pointer into a controlled write. From there, root is straightforward. The only requirement is CONFIG_FUTEX_PI, enabled by default in every major distribution: no privilege, no capability, no namespace.
The discovery matters on its own terms: Nebula Security found the bug with VEGA, an AI-assisted static analysis tool. Google paid $92,337 for the submission through kernelCTF. A fifteen-year-old use-after-free, found by a machine, sums up the new state of bug hunting.
The episode validates a trend worth taking seriously: AI-assisted bug hunting is starting to surface decades-old flaws that years of human review missed. That is not an indictment of the people who wrote the code — it is a reminder that adversaries now have tools that read code differently from how auditors historically have. A use-after-free sleeping since 2011 in locking code, found by a machine, is the symbol of that shift.
Why “local only” is not reassuring
Local privilege-escalation bugs are often filed under “less urgent” because they assume a foothold. GhostLock deserves more respect.
On a shared server, local access is the baseline: every tenant’s PHP process, every cron job, every mail account counts. A single SQL injection or stale plugin is enough to drop a web shell, and GhostLock turns that local process into root on the entire host, not just the compromised account.
Containers are not sheltered either. The bug works from inside a standard container, with no privileged user namespace. The IonStack chain proved the point: researchers chained a Firefox sandbox escape (CVE-2026-10702) with GhostLock into a web-page-to-kernel compromise on Firefox Android. For a hosting provider running containerized workloads, the threat model collapses the moment any container can trigger this path.
The patch state, two months on
The upstream fix (3bfdc63936dd, “rtmutex: Use waiter::task instead of current in remove_waiter()”) landed in 7.1 and was backported across every maintained line: 7.0.4, 6.18.27, 6.12.86, 6.6.140, 6.1.175, 5.15.212, and 5.10.261, between May and July 2026. Debian resolved its suites down to bullseye LTS (DLA-4717-1, on August 4), just before its end of life.
Blind spots remain. Red Hat confirms that CVE-2026-43499 and its companion CVE-2026-53166 — a crash introduced by the initial fix — affect RHEL 6 through 10 and every layered product (OpenShift, OpenStack, Virtualization). The community tracker kimmo.cloud notes that the RHEL 9 kernel-rt had not yet received the fix at last check, and that Amazon Linux 2, end-of-support since June 30, will receive no fix at all.
CVE-2026-53166 deserves separate attention: it stems from the initial fix, which is why the patch landscape took two months to settle.
How to close the path
The kernel fix is the only complete remediation, but interim mitigations exist.
# Check the running kernel version
uname -r
# RHEL 8 / 9 / 10: apply the fixed kernel and reboot
dnf update kernel
reboot
# On CloudLinux: verify a GhostLock livepatch is applied
kcarectl --patch-info | grep CVE-2026-43499A seccomp profile that blocks the three PI futex operations — FUTEX_LOCK_PI, FUTEX_WAIT_REQUEUE_PI, and FUTEX_CMP_REQUEUE_PI — closes the trigger path without touching the kernel. The cost is real: any application using priority-inheritance mutexes will break. For most web workloads it is a viable stopgap; for real-time services it is not.
The build options RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER raise the exploitation bar, but do not fix the bug and must not be treated as mitigation on their own.
The real-time paradox
There is an irony in the bug living precisely in rtmutex, the kernel path reserved for real-time scheduling and priority inheritance. -rt (PREEMPT_RT) kernels use this code the most — yet they are the ones distributions fix last, because the -rt patchset lives in a separate tree, often weeks behind the standard kernel.
That explains the blind spot documented by kimmo.cloud: the RHEL 9 kernel-rt was still awaiting its fix at the last check, while the standard kernel of the same release was already covered. For a trading floor, an industrial controller, or any system running a real-time kernel, the seccomp workaround that blocks PI futexes is precisely the one most likely to break the priority inheritance the application depends on. Real time therefore combines maximum exposure with minimum room to maneuver.
Verdict
GhostLock is a reminder that a fifteen-year-old bug in generic locking code affects every kernel, every architecture, every hosting provider.
If your kernel predates the fixed versions (7.0.4, 6.18.27, 6.12.86, 6.6.140, 6.1.175, 5.15.212, 5.10.261), apply the backport and reboot now, then deploy a seccomp block on PI futexes where the workload allows. If you run RHEL 9 kernel-rt or Amazon Linux 2, you are in a blind spot: migrate to a patched kernel or a still-supported distribution, because no fix is guaranteed. And until then, treat any application compromise as a kernel-level event.