Somewhere in the Linux kernel, a bug has been quietly aging like a fine wine since 2011 — back when Rebecca Black's "Friday" was topping charts and everyone thought Google+ might catch on. Turns out that bug just grew up into a five-second root exploit that works on basically every mainstream distro, which is one way to make an entrance.
A Decade-Old Typo With Root Privileges
Researchers at Nebula Security disclosed GhostLock, tracked as CVE-2026-43499, a use-after-free flaw in the Linux kernel's real-time mutex code, reachable through the futex subsystem. The bug traces back to a logic error introduced in Linux 2.6.39 back in 2011, meaning it has shipped by default in virtually every mainstream distribution for fifteen years without anyone noticing.
The exploit needs no special permissions, no unusual configuration, and no network access — just ordinary threading calls that any locally logged-in user, or process, can make. Nebula's working proof-of-concept hits full root in around five seconds with 97% reliability in testing, and it also breaks out of Docker and Kubernetes containers, which is the part that should make cloud teams sit up straight.
Why Your Patch Tuesday Just Got Urgent
This isn't some obscure edge-case flaw buried in a rarely used module — it's core kernel plumbing that shared hosting providers, container platforms, and basically every multi-tenant cloud environment depend on to keep users from touching each other's stuff. A reliable, no-privilege container escape is the exact nightmare scenario that "isolation" was supposed to prevent.
The good news: Nebula found this using its own AI-driven bug-hunting tool, VEGA, and responsibly reported it through Google's kernelCTF bounty program, earning a $92,337 payout instead of selling it to the highest bidder. The less good news: the initial patch introduced its own crash bug, and as of early July, Ubuntu still listed 24.04, 22.04, and 20.04 LTS as vulnerable or mid-fix. Translation: check your kernel version before you assume you're covered.
Fifteen years is a long time to keep a secret, and this one's now fully public — exploit code included. If you run shared infrastructure, today is not the day to skip your patch window.
Source: The Hacker News