In a momentous disclosure that underscores the pernicious nature of dormant code, ethical hackers at Nebula Security have unveiled GhostLock (CVE-2026-43499), a colossal 15-year-old Linux kernel vulnerability that enables complete root access and container escape.

The seminal discovery, part of their "IonStack" research series, not only illuminates the labyrinthine complexities of kernel memory management but also garnered the researchers a substantial $92,337 bug bounty reward from Google's prestigious kernelCTF program.

A Decade and a Half in the Shadows

GhostLock is a surreptitious use-after-free (UAF) flaw introduced in Linux 2.6.39 back in 2011, residing quietly within the kernel's real-time mutex (rtmutex) priority-inheritance mechanism. For over 15 years, this insidious defect lay dormant across virtually every major Linux distribution, only receiving a remediation in April 2026.

The vulnerability stems from a fundamental logic error in the remove_waiter() function. During a deadlock scenario requiring a rollback, the function erroneously clears the pi_blocked_on pointer on the requeuing task rather than the sleeping waiter. Consequently, the waiter task retains a dangling pointer to its own kernel stack frame, which is promptly obliterated upon returning to userspace.

Official Disclosure from Nebula Security

The Exploit Chain: From Stack-UAF to Root

Transforming this logical anomaly into a weaponized exploit required a meticulous exploitation chain. Nebula Security's researchers engineered a 97% stable privilege escalation by first leaking the kernel image slide and physmap base. They then capitalized on the stack-UAF to reclaim the waiter's freed kernel stack, forging a malicious fake rt_mutex_waiter structure over the freed frame.

This deception allowed them to execute a constrained arbitrary address write, ultimately overwriting the inet6_protos[IPPROTO_UDP] function table. By triggering a loopback IPv6 UDP packet, they achieved control flow hijack (CFH), culminating in a final stage dubbed "DirtyMode," which simply flips permission bits in userspace to usurp root privileges.

The KernelCTF Windfall and Industry Implications

The lucrative $92,337 payout from Google's kernelCTF program exemplifies the immense value placed on deep kernel research. Unlike standard bug bounties that often reward surface-level web vulnerabilities, kernelCTF incentivizes the arduous, highly technical work of finding esoteric memory corruption flaws.

For the broader cybersecurity community, GhostLock serves as a stark reminder of the ubiquitous risks posed by legacy code. Even with modern mitigations like KASLR and SMAP, a single 15-year-old logic error can circumvent them all, granting attackers unfettered access to the most sacrosanct rings of the operating system.