A 15-year-old Linux vulnerability has finally been patched, but not before it earned its discoverers a significant bug bounty reward. The flaw, tracked as CVE-2026-43499 and dubbed “GhostLock,” affects all major Linux distributions since 2011.
Nebula Security’s technical analysis reveals that the issue lies in a helper function designed to clean up after a task has been closed. Normally, this function would clear the current task from memory. However, due to the vulnerability, when a deadlock occurs and a rollback is requested, the function clears the memory while a pointer to it still exists in another task. This creates a use-after-free situation that can be exploited by attackers.
In essence, the flaw arises because the function assumes that the current task needs to be cleared up, but in cases where a requeue is requested, it ends up cleaning up on behalf of a sleeping thread instead of the current one. This oversight allows an attacker to control the inadvertently freed memory and gain local privilege escalation to root.
Nebula Security was able to exploit GhostLock to achieve exactly this outcome and demonstrated its potential for use in container escapes. As part of Google’s kernelCTF program, the team earned a $92,337 bug bounty reward for discovering and responsibly disclosing the vulnerability.
This is not an isolated incident; several Linux kernel flaws have been publicly disclosed over the past few months, including Januscape, Bad Epoll, DirtyClone, CIFSwitch, DirtyDecrypt (also known as DirtyCBC), Fragnesia, and DirtyFrag. These discoveries highlight the importance of regular security audits and updates to prevent widespread exploitation.
The GhostLock vulnerability serves as a stark reminder that even long-standing flaws can still pose significant risks if not addressed promptly. Linux distributions will need to prioritize patching this issue to ensure their users’ systems remain secure. Meanwhile, system administrators should review their kernel configurations and apply the available patches to minimize potential exposure.
As we continue to witness the emergence of new vulnerabilities, it’s essential for organizations to stay proactive in their security efforts. By keeping software up-to-date and monitoring for signs of exploitation, companies can reduce their risk profile and protect against potential attacks.
Source: SecurityWeek — 2026-07-09