A tiny mistake in Linux's core, the kernel, sat there for 15 years, and on any machine that hasn't been patched it hands a normal user full control. Any logged-in account, with no password tricks and no special access, can turn itself into root, the all-powerful admin. The vulnerable code has shipped by default in essentially every mainstream Linux distribution since 2011.
Nebula Security, the firm that found it, calls the bug GhostLock. Its team turned the flaw into an attack that takes over an unpatched machine 97% of the time and even breaks out of containers, the sealed boxes meant to keep programs apart. Google paid the team $92,337 for reporting it.
How one slip broke it
The bug sits in the part of Linux's core that decides which task goes first when two of them want the same lock. During a rare cleanup step, the code checked the wrong task, the one running right then instead of the one that had been waiting.
That slip left the system trusting a scrap of memory it had already thrown out. An attacker who nails the timing can slip their own data into that scrap and promote themselves to root. The fix, tracked as CVE-2026-43499, is a small change to that same locking code.
Cyber Security News on how GhostLock works
Why it matters now
On its own, GhostLock needs the attacker to already have a foothold, so it's rated high, not critical. That sounds reassuring until you remember how attacks get chained. A hacker who first slips in through another bug, say a browser exploit or a cheap rented account on a shared server, can use GhostLock to jump from that foothold to full root.
The Hacker News on the GhostLock disclosure
What to do
Anyone can grab the exploit code now, because Nebula published it, though no one's been caught using it yet. The fix is already in current Linux updates. Patch now. The very first version of the fix could crash the system in a rare case, so grab the latest kernel version, not just the first patched build.
The Linux kernel fix for GhostLock
GhostLock is a reminder that the scariest bugs aren't always new. This one hid in plain sight in boring, rarely read code for 15 years, until an AI tool went hunting through the kernel and spotted it. There's almost certainly more like it.
