Linux Kernel rtmutex Priority-Inheritance Stack-UAF — "GhostLock" (CVE-2026-43499, Nebula Security weaponized variant)

Metadata

Affected Target

Summary

Nebula Security independently discovered and weaponized a use-after-free in the Linux kernel’s rtmutex priority-inheritance cleanup logic, naming it “GhostLock.” They describe it as a stack-UAF reachable via ordinary threading/futex calls from any unprivileged local process, requiring no special permissions or configuration beyond CONFIG_FUTEX_PI (enabled by default on essentially all mainstream distributions). Nebula turned it into a working root exploit that is ~97% reliable in their testing and also escapes containers. Google awarded Nebula $92,337 for the finding through its kernelCTF bug-bounty program. Nebula also chains GhostLock with CVE-2026-10702 (a Firefox sandbox escape) into a full browser-to-root exploit chain they call “IonStack” — GhostLock is the second (privilege-escalation) stage of that chain.

This appears to be the same underlying CVE/root cause as the crash-only rtmutex remove_waiter() PoC already archived at 2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf (also CVE-2026-43499, also rtmutex priority-inheritance), but is recorded as a separate entry because it is a distinct, independently-developed weaponized exploit (full root + container escape, 97% reliability) from a different research team (Nebula Security vs. MobiusM/upstream reporters), with different technical framing (“stack-UAF”) and no shared exploit code between the two.

Vulnerability Details

Root Cause

Per Nebula Security’s own writeup (“IonStack part II”): incorrect cleanup logic in the kernel’s rtmutex priority-inheritance code leaves a stack-resident object referenced after it should have been invalidated, producing a use-after-free reachable through the futex-PI code path. This is consistent with the same rtmutex/futex-PI proxy-lock rollback defect tracked elsewhere in this archive (see the related entry for the detailed remove_waiter() / pi_blocked_on mechanics), but Nebula’s own technical writeup should be consulted for their exact characterization and exploitation primitives, which have not been independently reproduced in this repository.

Attack Vector

An unprivileged local process makes ordinary threading/futex calls (no special permissions, no unusual configuration, no network access) to trigger the use-after-free, then uses it as a reliable (~97%) privilege-escalation primitive to obtain root, including escaping containers.

Impact

Full local privilege escalation to root, with container escape, from any unprivileged local login — on any unpatched Linux system with CONFIG_FUTEX_PI enabled (the default across mainstream distributions since 2011).

Environment / Lab Setup

Not reproduced in this repository — no exploit code from Nebula Security has been mirrored here. See Nebula’s own research post for their environment and exploitation details.

Proof of Concept

No exploit code is included in this entry. Nebula Security has publicly released their own exploit code (referenced from their disclosure); this repository does not mirror it. For a locally-reproducible crash-only PoC of the same underlying rtmutex/futex-PI bug, see the related entry: 2026-07-05_cve-2026-43499-rtmutex-remove-waiter-uaf.

Detection & Indicators of Compromise

No IOC/log signature independently confirmed for Nebula's specific exploit path.
See the related entry's dmesg signature for the shared rtmutex/futex-PI crash path:
  "Unable to handle kernel write to read-only memory at virtual address ..."
  PC is at rt_mutex_adjust_prio_chain+...
  Call trace includes: futex_lock_pi -> do_futex -> __arm64_sys_futex

Remediation

References

• The Hacker News — 15-Year-Old GhostLock Flaw Enables Root and Container Escape on Most Linux Distros
• Nebula Security — IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
• Nebula Security on X — disclosure thread

Notes

This entry documents Nebula Security’s public disclosure of GhostLock (2026-07-08). It is deliberately kept separate from the earlier-archived crash-only PoC for the same CVE (added 2026-07-05, sourced from MobiusM’s repo) rather than merged into it, since the two represent different researchers’ independent work on what is reported to be the same underlying bug — merging them would have overwritten/conflated a working, locally-reproducible crash PoC with an external, unverified weaponized-exploit claim. No exploit code from Nebula has been reproduced or mirrored here; only their public claims and technical description are summarized, sourced to the references above.