Nebula Security researchers have identified GhostLock, a linux kernel Vulnerability tracked as CVE-2026-43499 that has been present since Linux 2.6.39 in 2011.
The flaw allows attackers with local access to escalate privileges to root almost all major Linux distributions released since then. Linux kernel version 7.1 includes a fix for the problem, but currently the only practical precaution is to install the updated kernel.
The vulnerability was discovered by Nebula Security’s VEGA artificial intelligence agent, and Google awarded a bug bounty of $92,337 through its kernelCTF program. During testing, the exploit worked successfully 97 percent of the time.
What GhostLock does and which Linux systems are affected
GhostLock is a local privilege escalation vulnerability that allows an attacker with access to a system to potentially gain full root privileges and take full control.
The flaw arises from a helper function within the Linux kernel scheduling system, responsible for cleaning up tasks upon completion. When a deadlock occurs and a rollback is initiated, the function can free memory while another task still maintains a reference to it. This situation creates a use-after-free condition that attackers can exploit.
The vulnerability is present in Linux kernel versions from 2.6.39, released in 2011, through Linux 7.0, and affects almost all major Linux distributions released since 2011. It affects both server and desktop Linux systems, particularly those where an attacker has already established some level of local access.
Given its 15-year history, GhostLock has been a persistent issue that has affected the vast majority of Linux systems deployed around the world during that period.
Why only a patched kernel fixes it and what users should do
There is currently no practical solution or mitigation for GhostLock. Nebula Security has stated that the only reliable solution is to install the patched kernel.
Users and administrators of affected systems should check their current kernel version by running uname -r on the affected device and then upgrade to Linux 7.1 or a newer version via the distribution’s standard package management system.
After the update, a system reboot is required to activate the new kernel, and you should verify that the update was successful by checking uname -r again after the reboot.
For enterprise Linux distributions such as Red Hat Enterprise Linux, SUSE Linux Enterprise, and Ubuntu LTS, vendors are expected to support the solution in their supported versions. Users of these distributions should be alert for kernel updates through their usual update channels.
For distributions that use the main kernel directly, installing a 7.1 series kernel or later will resolve the issue.
GhostLock requires local access to exploit, which serves as a mitigating factor. An attacker must first gain some level of access to the system before using GhostLock to escalate privileges.
Common ways to gain initial access include compromised user accounts through phishing or credential theft, user-installed malware, shared systems with multiple users, exploits of other vulnerabilities that allow code execution, or physical access to unattended devices.
Because GhostLock has a high success rate of 97 percent, once an attacker has some type of local access, the tool offers a nearly safe path to root privileges.
How AI helped find GhostLock and where the solution is available
VEGA, an AI bug-finding and security agent developed by Nebula Security, discovered a flaw. Nebula claims that VEGA can identify vulnerabilities faster than human researchers.
This discovery highlights a broader shift in vulnerability research. Other recent examples include Anthropic’s Mythos model, which found vulnerabilities in highly sensitive US government systems during a testing exercise in June 2026.
Senator Mark Warner reported that National Security Agency chief Joshua Rudd said Mythos “broke into nearly all of our classified systems, not in weeks, but in hours.”
The pattern suggests that AI-assisted vulnerability discovery is becoming an important part of both defensive and offensive security efforts. Old code that hasn’t been examined for years, like the 15-year-old feature behind GhostLock, is likely to receive renewed attention as AI tools become more capable.
For Linux system administrators, it is recommended to prioritize kernel updates on production systems, especially those with multiple users or shared access:
- Verify that update paths are available through the current distribution’s package management system.
- Review recent activity on affected systems for signs of prior exploitation.
- Consider whether access controls for local accounts need to be tightened.
For desktop Linux users, update to the latest available kernel version via the distribution’s standard update mechanism:
- Reboot after installing kernel updates to activate the new version.
- Note that some distributions delay breaking kernel version changes; verify that the specific fix has been included in the installed kernel.
For cloud infrastructure users, verify that the vendor images have been updated to include the patched kernel:
- Rebuild virtual machines from updated base images if necessary.
- Consider running vulnerability scans on production systems to identify those that have not yet been patched.
Nebula Security’s disclosure and Google’s recognition of the kernelCTF program offer baseline details that security teams can use to verify their systems. Checking the kernel version is still the easiest way to confirm if GhostLock has been fixed.
Additionally, detection methods for local privilege escalation, such as endpoint monitoring, audit logs, and behavioral analysis, are the primary tools for identifying potential exploitation.
GhostLock is part of a growing list of Linux kernel vulnerabilities discovered in recent years. Older code, developed before modern security review practices, often contains subtle bugs that can appear years later. The combination of AI-assisted discovery and the extensive Linux kernel codebase suggests that more such findings are likely.
Linus Torvalds recently expressed frustration with AI-generated bug reports, especially those that highlight kernel security issues without providing clear exploit paths.
In contrast, GhostLock is different: it includes a working exploit, a high success rate, and a significant reward, all of which support the validity of the finding.
Linux 7.1 with the GhostLock patch is now available through major kernel repositories, distribution package management systems for those who have incorporated the solution, and updated cloud images from major infrastructure providers. Users should install the update as soon as their distribution offers a new kernel version, as there is no interim mitigation available while waiting.
