CVE-2026-43499 (GhostLock) is a use-after-free in the Linux kernel’s rtmutex code that lets a local user gain root and, on shared hosts, escape containers. NVD rates CVE-2026-43499 at CVSS 7.8, but a public, highly reliable root exploit from Nebula Security makes it more dangerous than the score implies, patch to your distribution’s fixed kernel and reboot.

GhostLock (CVE-2026-43499): Linux Root Flaw, Distro Patches

GhostLock (CVE-2026-43499) is a 15-year-old use-after-free in the Linux kernel rtmutex code that lets any logged-in local user gain root and escape containers. A public, 97%-reliable exploit exists, so unpatched machines should be treated as urgent, even though it is not yet in CISA KEV.

What happened. Researchers at Nebula Security disclosed GhostLock, tracked as CVE-2026-43499 (CVSS 7.8, CWE-416 use-after-free). It is a flaw in the kernel real-time-mutex (rtmutex) priority-inheritance code that has shipped by default in essentially every mainstream Linux distribution for years. During a proxy-lock rollback from futex_requeue(), remove_waiter() operates on the wrong task, leaving a dangling pointer primed for use-after-free. Nebula turned it into a working root exploit that also escapes containers and was awarded $92, 337 through Google kernelCTF. It is fixed upstream (kernel.org commit 3bfdc63936dd), and the exploit code is public (disclosed via oss-security on July 8, 2026).

Which Linux distributions are affected?

Practically all of them, because the vulnerable rtmutex code is upstream. Patch status is moving quickly, confirm against each vendor advisory:

Who is affected. Any multi-user or container host running an unpatched mainstream kernel, which, given the long lifetime of the bug, is most Linux estates. It needs no special permission, no unusual configuration, and no network access; ordinary threading calls from any local program are enough.

Is GhostLock being actively exploited?

Not yet observed in the wild, and it is not in CISA KEV (EPSS also sits near the 2.6th percentile). But that understates the risk: a public, 97%-reliable exploit already exists, so exposure is real today regardless of the KEV and EPSS signals.

How do I fix CVE-2026-43499?

Update the kernel to your distribution's patched build and reboot. If you cannot patch immediately, the kernel build options RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER make the exploit harder, but they are mitigations, not fixes.

Our read. GhostLock is a clean example of why point-in-time signals mislead: CVSS is 7.8, EPSS sits low, and it is not in KEV, yet a public exploit gives root on most Linux hosts on Earth. In our analysis of the 2025 KEV catalog, exploitation routinely arrived before the tidy risk signals caught up; the same gap is open here. Continuous verification, confirming which of your hosts are actually exploitable, not just which CVEs are trending, is the only thing that closes it.

Reporting by The Hacker News; technical detail from Nebula Security and the kernel.org commit. CVE-2026-43499 rated CVSS 7.8, CWE-416 (use-after-free). Sources linked above.

Frequently asked questions

Is my Linux distribution patched against CVE-2026-43499?

Fixes have landed upstream and in the major distributions (RHEL, Debian, Ubuntu, Rocky, AlmaLinux). Check your distribution’s security tracker for the exact patched kernel build, then update and reboot, a running unpatched kernel is still vulnerable.

Is there a public exploit for CVE-2026-43499 (GhostLock)?

Yes. Nebula Security published a highly reliable root exploit, which is why this matters despite a modest CVSS and low EPSS score.

Can GhostLock be used to escape a container?

Yes. It is a local kernel use-after-free that yields root, which on shared or multi-tenant hosts can be leveraged to break out of a container.

How serious is CVE-2026-43499 really?

NVD scores it CVSS 7.8 (High) with low EPSS, but a public, reliable root exploit means real-world risk is higher than the number suggests. Treat it like a critical local privilege-escalation bug.

How do I check if I am affected?

Compare your running kernel version against your distribution’s patched build for CVE-2026-43499. Multi-tenant, container, and CI hosts should be patched first.