Loading story…
Researchers disclosed GhostLock (CVE-2026-43499), a long-hidden Linux kernel local privilege-escalation flaw that has existed since 2011 and affects nearly all mainstream distributions. The bug resides in priority-inheritance futex and real-time mutex handling, where a race condition can trigger a use-after-free and dangling pointer, allowing a logged-in unprivileged user to gain root on unpatched systems. The vulnerability affected kernels from Linux 2.6.39 through version 7.1, and researchers reported a weaponized exploit with high reliability.
The exploit can also enable container escape, raising risk for multi-user, cloud, and containerized environments. Researchers said the attack can bypass KASLR, hijack kernel control flow through the inet6_protos table, and use the DirtyMode technique to complete privilege escalation; they also tied GhostLock to a broader IonStack chain in which a Firefox flaw (CVE-2026-10702) delivers code execution before GhostLock elevates privileges, including in a demonstrated Firefox-on-Android scenario. The flaw was patched upstream in April under commit 3bfdc63936dd, but the initial fix introduced a separate crash bug (CVE-2026-53166), prompting defenders to deploy current kernel updates rather than early patched builds.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Red Hat's Bugzilla entry for CVE-2026-43499 states the Linux kernel rtmutex flaw was fixed for NVIDIA for RHEL 10 through advisory RHSA-2026:37728. The record describes the underlying remove_waiter() task-handling bug in futex proxy-lock rollback paths and notes the issue had already been addressed upstream.
AlmaLinux announced that all supported AlmaLinux OS releases 8, 9, and 10 are affected by GhostLock (CVE-2026-43499) and published backported patched kernels to its testing repositories for community validation before production release.
Nebula Security publicly disclosed GhostLock, describing it as a Linux local privilege-escalation flaw that can give logged-in users root access and enable container escape on unpatched systems. The disclosure included public exploit code and technical details showing high exploit reliability and use in the broader IonStack exploit chain.
The Linux kernel upstream fixed CVE-2026-43499 in April 2026 under commit 3bfdc63936dd. The initial fix reportedly introduced a separate crash issue later tracked as CVE-2026-53166, prompting guidance to use current kernel updates rather than early patched builds.
The GhostLock Linux kernel vulnerability, later tracked as CVE-2026-43499, was introduced in Linux 2.6.39 in 2011 and remained present for years in the kernel's futex priority-inheritance handling.
The official CVE record for GhostLock (CVE-2026-43499) was published, describing a high-severity Linux kernel rtmutex flaw caused by remove_waiter() using current instead of waiter::task during futex proxy-lock rollback. The record later listed stable-branch fix commits and scored the issue 7.8 CVSS v3.1.
The GhostLock fix for CVE-2026-43499 was backported to stable Linux kernel branches on 2026-05-04 after the upstream fix landed on 2026-04-20. This added a downstream remediation milestone beyond the earlier upstream patch.
The Linux kernel stable tree published commit 3bfdc63936dd updating rtmutex remove_waiter() to use waiter::task instead of current. The patch corrected proxy-lock rollback and priority-inheritance handling in the code later associated with GhostLock, CVE-2026-43499.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
44 references tracked. Mallory keeps watching after this page renders.
linuxsecurity.com
Open sourcexakep.ru
Open sourceghacks.net
Open sourcecyberveille.ch
Open sourcegit.kernel.org
Open sourcegit.kernel.org
Open sourcegoogle.github.io
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two separate Linux kernel privilege-escalation flaws that can give local attackers **root** access across a wide range of systems, including servers, desktops, and Android devices. One bug, **`CVE-2026-46242`** or **Bad Epoll**, is a use-after-free race in the kernel's `epoll` subsystem that was reportedly exploited through Google's kernelCTF program and shown to be broadly reachable because `epoll` is a core component that cannot be disabled. The flaw was introduced by a 2023 kernel change, and reporting said an initial patch attempt was insufficient before a correct fix was merged weeks later, leaving defenders dependent on upstream fixes and vendor backports. A second flaw, **`CVE-2026-43456`**, affects the kernel's `net/bonding` subsystem and stems from a type-confusion condition dating back to 2007. Researchers said the bug can be exploited with high reliability for local root by abusing incompatible `header_ops` handling in bonded network devices, enabling controlled memory corruption and eventual code execution. The issue reportedly affects Linux versions **2.6.24 through 6.12.77** and requires **`CAP_NET_ADMIN`** privileges; mitigations include applying the March 2026 patch, or temporarily disabling unprivileged user namespaces or the bonding module where feasible.
Jul 11, 2026
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026
Researchers disclosed **CVE-2026-31431**, dubbed **CopyFail**, a Linux local privilege escalation flaw in the kernel crypto subsystem's `algif_aead`/`AF_ALG` AEAD path that lets a low-privileged local user corrupt the page cache of readable files and gain root. The bug traces to a 2017 in-place AEAD optimization introduced in Linux 4.14 by commit `72548b093ee3`, which allowed splice-backed file pages to be reused as writable crypto buffers; attackers can then achieve a controlled write into the cached copy of targets such as setuid binaries while leaving the on-disk file unchanged. Researchers published a compact Python proof of concept said to work reliably across major distributions including Ubuntu, RHEL, SUSE, Amazon Linux, Debian, Fedora, and Arch, and warned the shared page cache also makes the flaw relevant for container escapes, CI runners, and multi-tenant cloud hosts. Upstream fixed the issue by reverting `algif_aead` to out-of-place operation in Linux **7.0**, **6.19.12**, and **6.18.22**, while older long-term branches initially lagged because the patch did not apply cleanly and required backports or workaround patches. Major vendors and downstream projects began shipping advisories and kernel updates, and temporary mitigations included disabling or blacklisting `algif_aead`, blocking `AF_ALG` socket creation with seccomp or eBPF, or using the kernel boot parameter `initcall_blacklist=algif_aead_init` where the feature was built in. After public exploit code spread and additional exploit ports appeared, **CISA added the flaw to its Known Exploited Vulnerabilities catalog**, and defenders published detections focused on suspicious `AF_ALG`, `splice()`, and setuid execution activity because traditional file-integrity checks may miss the in-memory-only tampering.
Jul 23, 2026