This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Linux fixes high-severity "GhostLock" vulnerability

Linux fixes a high-severity vulnerability in the Linux kernel named "GhostLock", which affects all major distributions since 2011 [1]. To remediate the vulnerability, it is recommended to merge upstream commit 3bfdc63936dd [2] or upgrade to the fixed version of your distribution release, if available. All systems with upstream kernel versions from v2.6.39-rc1 up to v7.1-rc1 are vulnerable[1]. Red Hat has not yet released any fixes; Ubuntu has released an update for the resolute release (7.0.0-27.27)[3]. Debian releases and their fixed versions [4]: bullseye (security) - 6.1.176-1~deb11u1 bookworm (security) - 6.1.176-1 trixie - 6.12.86-1 trixie (security) - 6.12.95-1 forky - 7.0.13-1 sid - 7.1.3-1

Linux kernel - LPE (CVE-2026-43499)
CVSS 7.8 (High)

An authenticated local attacker can, through a use-after-free on the kernel stack in the rtmutex lock management mechanism, where improper handling of proxy locking on behalf of a sleeping thread results in incorrect state cleanup during a requeue operation and leaves a pointer to freed memory, corrupt kernel memory and subsequently escalate their privileges to root or escape from a container [1]. A PoC is publicly available [5].

The vulnerability is present in product:

  • Linux kernel; >=2.6.39, <=7.0;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 21. 5. 2026.

By CESNET, z.s.p.o. Táňa Macháčková on 9. 7. 2026.

CESNET, z.s.p.o. Logo