GhostLock: A 15-Year Linux Kernel Vulnerability Found by VEGA
GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years
I discovered GhostLock, a critical stack-use-after-free vulnerability in the Linux kernel that has affected every major distribution for over 15 years. By exploiting a flaw in the rtmutex rework, we achieved a stable privilege escalation and container escape without needing special privileges. This research details how we turned this bug into a winning kernelCTF submission, earning a significant bounty from Google.
GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found by VEGA that exists in every major distribution since 2011.
- goodburb
Tested on three Android devices (version 9, 13, 16) with different Firefox versions under 150 (had to modify for older).
Two boot looped, I had to enter recovery and the other just powered off [0].
The demo modifies the wallpaper on supported Pixel devices.
[0] IonStack https://rootme.nebusec.ai
____
Tip: Install a Chromium flavor browser (Chromite) separate from the main browser.
Disable Javascript and hardware accelerated video decoder (commonly exploited) from the flags page and enable reader mode to fix broken JS-dependent websites when browsing blogs and random sites on your personal devices, else dedicate a tablet.
- password4321
Forgot to include "LPE" (local...) in the title so most of us can get back to weekending.
- amatecha
Daaaaamn: "GhostLock was introduced in Linux 2.6.39 and fixed in Linux 7.1."
- teleforce
>Google has rewarded us $92,337 in kernelCTF
I'm all ears now
- 0x1ceb00da
Does that mean any android app can use ndk native code execution to become root? Does selinux help here?
- reorder9695
Could this be used to unlock bootloaders on typically non unlockable phones? If so this could be one of the best things to happen to Android.
- pkoiralap
Huge kudos to the security researchers for 1, finding an exploit, and 2, unlike copyfail, excluding a zero-day ready-to-use LPE script that anyone could have used.
I tried using this for LPE on a Rocky9 for a couple of hours and thankfully couldn't get it to work. So that means unless you have quite some free time on your hand, or are extremely good at doing what you do, you can't actually use this to get LPE on enterprise distros.
- anthk
A good think I use JS less browsers.