Ghost in the Kernel
A 15-year-old vulnerability lurking in the Linux kernel has been uncovered — not by a human researcher, but by an AI. Nebula Security has disclosed GhostLock (CVE-2026-43499), a use-after-free bug in the kernel's futex (fast userspace mutex) code that went undetected since it was introduced in 2011.
The flaw has shipped by default in essentially every mainstream Linux distribution for 15 years. It requires no special permissions, no unusual settings, and no network access — ordinary threading calls from any local program are enough to trigger it.
Root in Five Seconds
Nebula Security turned GhostLock into a working exploit that is 97% reliable in their testing. On their test machine, it takes about five seconds to go from an unprivileged user to full root control. The exploit also breaks out of containers, making it a serious threat in cloud and multi-tenant environments.
The bug exists in the kernel's priority inheritance mechanism for futexes — a system designed to prevent high-priority tasks from being blocked by lower-priority ones. In one rare edge case, a cleanup routine runs at the wrong moment and wipes the wrong task's record, leaving the kernel holding a pointer to memory it has already freed and reused. From that use-after-free, Nebula's team chained several exploitation steps to achieve arbitrary code execution as root.
AI Found What Humans Missed
Nebula discovered GhostLock using VEGA, the company's AI-driven bug-hunting tool. The vulnerability is part of a disturbing trend in 2026: automated tools are uncovering deep-seated Linux kernel bugs that human reviewers overlooked for years. Earlier this year, researchers disclosed 'Bad Epoll' (CVE-2026-46242), a similar privilege-escalation bug in the same area of code.
'What these bugs share is old, heavily used kernel machinery that few had reread in years, until automated tools started combing it,' Nebula noted. The futex priority inheritance code dates to 2011.
The Full Chain: From Browser to Root
GhostLock is also the second half of a chain Nebula calls IonStack. The first half, CVE-2026-10702, is a Firefox vulnerability that allows code execution inside the browser and sandbox escape. Combined with GhostLock, a single tap on a malicious link can give an attacker full control of an Android device.
Patch Now
The original flaw was fixed in the Linux kernel in April, but the initial patch introduced a separate crash bug (CVE-2026-53166). Distributions are now rolling out the corrected fix. Nebula has published working exploit code, making it critical to patch shared and multi-tenant machines — cloud servers, containers, and CI runners — first. There is no complete workaround, as the operations that trigger GhostLock are routine for any local process.
