GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years

	GhostLock, a stack-UAF that has existed in all Linux distributions for 15 years(nebusec.ai)
	412 points by ranger_danger 64 days ago \| 194 comments
	tl;dr: Researchers at VEGA disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel stack use-after-free in the rtmutex code, where `remove_waiter()` incorrectly clears `current->pi_blocked_on` instead of the actual waiter's during a FUTEX_CMP_REQUEUE_PI rollback, leaving a dangling pointer to freed stack memory. They chained it into a 97% reliable unprivileged root/container escape by reclaiming the stack via `prctl(PR_SET_MM_MAP)`, using an rb-tree erase to overwrite `inet6_protos[IPPROTO_UDP]`, pivoting through the CPU entry area, and flipping `core_pattern`'s mode bits — earning $92,337 in kernelCTF. Fixed in Linux 7.1.
	HN Discussion: ↑Users testing the exploit on their own devices and sharing hands-on results •Curiosity about implications for Android security, including app privilege escalation and bootloader unlocking ↑Amazement at the long lifespan and scope of the vulnerability ↑Praise for researchers' responsible disclosure without releasing ready-to-use exploit ↑Concern about the vast attack surface of modern kernels, considering alternatives