GhostLock: A 15-Year-Old Linux Kernel Flaw Just Gave Anyone Root — Including from Inside Your Docker Container
If you run Docker, self-host services, or maintain any Linux server where unprivileged users have shell access, there is a reason to wake up a little early today.
On July 8, 2026, Nebula Security disclosed GhostLock — tracked as CVE-2026-43499 — a use-after-free vulnerability in the Linux kernel’s real-time mutex code that lets any local user escalate to root. Not with a complex multi-stage exploit requiring special hardware. Not with a race condition that works 1% of the time. Nebula Security’s public exploit succeeds 97% of the time, and the code has already been published.
The most worrying detail for anyone running containers: GhostLock works from inside a Docker container to escape to the host kernel. A compromised container is no longer contained.
What the bug actually is
GhostLock lives in kernel/locking/rtmutex.c — the code that handles priority inheritance for futexes (fast user-space mutexes), a core threading primitive used by virtually every modern Linux application. The vulnerable code path was introduced in Linux 2.6.39, released in 2011, and has sat in every mainstream distribution since. Fifteen years.
Andrew Lukoshko, lead architect at AlmaLinux, explained the mechanism in a detailed write-up: the helper function remove_waiter() assumes the waiter it is cleaning up always belongs to the currently running task. But during a deadlock-cycle rollback — specifically on the FUTEX_CMP_REQUEUE_PI requeue path — the kernel unwinds on behalf of a different, sleeping thread. This clears pi_blocked_on on the wrong task, leaving a dangling pointer into freed kernel stack memory. A classic use-after-free.
An attacker triggers it by arranging three futexes and a set of coordinated threads into a priority-inversion deadlock, then reclaiming the freed stack frame with a forged waiter structure. From there, the constrained write chains into arbitrary kernel read/write, control-flow hijack, and root. No special capabilities required. No unusual kernel configuration needed — the only dependency is CONFIG_FUTEX_PI, which is enabled by default on essentially every distribution.
Why this matters for self-hosting
I analyse this from a slightly different angle than most security news outlets: not “is this exploitable” (yes, it is), but “does this affect your homelab.”
If you are running Docker or Kubernetes on any Linux host, the container escape vector is the one that matters. Every Docker container shares the host kernel. A container escape via GhostLock doesn’t just compromise the container — it compromises the host. That means all your other containers, your volumes, your SSH keys, everything.
For multi-user systems — any server where you’ve given someone a non-root account, a CI/CD runner where jobs execute as unprivileged users, or a shared development machine — the risk is even more direct. Any logged-in user can go straight to root.
The CVSS score is 7.8 (High): CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Local attack vector, low complexity, low privileges required, no user interaction. The numbers tell the full story.
Patching
The fix has been pushed across major distributions. AlmaLinux confirmed patched kernels for all supported releases — 8, 9, and 10 — as of July 9. The fixed versions are kernel-4.18.0-553.141.2.el8_10 (AlmaLinux 8), kernel-5.14.0-687.24.1.el9_8 (AlmaLinux 9), and kernel-6.12.0-211.32.1.el10_2 (AlmaLinux 10), or higher.
Ubuntu, Debian, RHEL, and Fedora have also released patches. The command is simple on most systems:
sudo dnf clean metadata && sudo dnf upgrade
sudo reboot
Or equivalent for your package manager. The catch: you must reboot. A running kernel cannot patch itself — GhostLock is in the kernel, not a userspace library. Until you reboot into the patched kernel, you’re exposed.
Google awarded Nebula Security 2,337 GCH (Google bug bounty credits) through its kernelCTF program. Working exploit code has been published. There have been no confirmed reports of wild exploitation as of July 12, but with public exploit code and 97% reliability, weaponisation by threat actors is a question of days, not weeks.
The bigger picture
Fifteen years is not an outlier. Kernel vulnerabilities this old surface regularly — the Linux kernel is one of the oldest continuously developed codebases in general use, and its threading subsystem has never been considered “low risk” by security researchers. GhostLock is a reminder that the attack surface of a self-hosted homelab isn’t just the services you choose to run; it’s also the kernel underneath everything.
Patch today. Reboot tonight. Your containers will thank you.
Sources:
– Nebula Security research report (The Hacker News)
– AlmaLinux GhostLock advisory — Andrew Lukoshko, July 9
– CVE-2026-43499 threat analysis (Threat Modeling)
