- GhostLock (CVE-2026-43499) is a Linux kernel vulnerability found in all major distributions since 2011.
- It allows unprivileged local attackers to get a dangling kernel pointer, write to arbitrary addresses, and hijack function tables for privilege escalation.
- The bug exists in Linux versions 2.6.39 to 7.1 and was fixed in April 2026.
- Exploitation involves creating a PI futex deadlock to trigger a use-after-free on kernel stack memory.
- Attackers can reclaim freed stack memory via PR_SET_MM_MAP and forge fake rt_mutex_waiter structures.
- The exploit overwrites inet6_protos[IPPROTO_UDP] to hijack control flow and gain root access via DirtyMode.
- Mitigations include patching the kernel, enabling RANDOMIZE_KSTACK_OFFSET, and using STATIC_USERMODE_HELPER.