Futex

GhostLock: The 15-Year-Old Linux Kernel Bug AI Found Hiding in Plain Sight TL;DR An AI-powered security agent discovered a Linux kernel vulnerability that has existed in every major distribution since 2011. It allows any unprivileged local user to gain full root access with a 97% success rate. There is no practical mitigation — patch your kernel. Attribute Detail CVE CVE-2026-43499 CVSS 3.1 7.8 (HIGH) — AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CWE CWE-416 (Use After Free) Affected Linux 2.6.39 through 7.0 Fixed Linux 7.1 (commit 3bfdc63936dd) Stable backports 6.1.177, 6.6.144, 6.12.95, 6.18.36, 7.0.13 Not backported 5.15.y, 5.10.y LTS Discovered by VEGA AI Agent (Nebula Security) Bounty $92,337 (Google kernelCTF) Prerequisites Local access, no special privileges, CONFIG_FUTEX_PI=y What Is GhostLock? GhostLock (CVE-2026-43499) is a use-after-free vulnerability in the Linux kernel’s real-time mutex (rtmutex) priority-inheritance code. Specifically, it lives in the remove_waiter() function in kernel/locking/rtmutex.c. ...