GhostLock: the fifteen-year-old Linux kernel flaw that grants root in seconds

A use-after-free vulnerability that lived inside the Linux kernel since 2011 lets any authenticated local user become root — and escape from a container onto the host.

Six months ago, a quietly disclosed flaw dubbed GhostLock (CVE-2026-43499) sent ripples through the systems community. It is a stack use-after-free bug sitting in the Linux kernel's real-time mutex (rtmutex) priority-inheritance code — a routine part of how the kernel schedules tasks sharing a lock. The flaw was introduced in kernel 2.6.39-rc1 in 2011 and remained in mainline for about fifteen years, until a fix landed in April 2026. By the time it was publicly described, a working proof-of-concept exploit was already circulating.

The severity in one line: any unprivileged local user who can run code on a machine can trigger GhostLock to gain full root access, with no special capabilities required. The same path also works from inside a container to break out onto the host.

Why a mutex bug becomes root access

Modern Linux uses a mechanism called priority inheritance to prevent a subtle class of scheduling deadlock called priority inversion. When a low-priority task holds a lock that a high-priority task needs, the kernel temporarily boosts the holder's priority so it can release the lock quickly. The rtmutex code maintains a small stack-allocated bookkeeping structure to track these boosts.

GhostLock exploits a case where that structure is freed while a pointer to it still lives on the stack. A carefully crafted sequence of lock operations lets an attacker reuse that freed memory and redirect kernel control flow — a classic use-after-free turned into privilege escalation.

Containers are not safe from it

The more striking part is the container escape path. Containers rely on namespaces and kernel-level isolation rather than full virtualisation, so a kernel compromise immediately undermines the boundary. Because GhostLock needs only code execution on the box (not outside the container), a compromised service running inside a container can use it to step onto the host kernel as root. That makes it especially relevant to shared cloud, serverless and multi-tenant deployments.

The fix and the lesson

Major distributions began shipping patched kernels immediately after disclosure, and the fix closed the reuse window in the rtmutex priority-inheritance code. The broader lesson is a sobering one for any long-lived systems project: a single stack-use-after-free, once it reaches mainline, can sit unnoticed for over a decade and then become simultaneously a local root and a container-breach vector.

Knowledge takeaway: GhostLock (CVE-2026-43499) is a stack use-after-free in Linux rtmutex priority-inheritance code present since 2011; it grants root to any local user and enables container escape; patched kernels from major distributions close the reuse window.