Linux kernel futex priority-inheritance use-after-free ('GhostLock')
Linux kernel futex priority-inheritance use-after-free present since 2011. Any local user can gain root; container escape confirmed. Public exploit; patch.
- Vendor
- Linux Foundation
- Product
- Linux kernel (upstream mainline and all mainstream distro kernels shipping the futex PI code path since 2011)
- CVSS
- 7.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
GhostLock is a use-after-free in the Linux kernel’s futex priority-inheritance code path, disclosed on 2026-07-08 by Nebula Security as part of their IonStack research. The vulnerable code has shipped by default in essentially every mainstream Linux distribution since 2011, meaning current LTS releases of Ubuntu, Debian, Fedora, Rocky, SUSE, and Arch all carry it prior to distro security backports.
A local unprivileged user with the ability to run ordinary threaded programs can escalate to root and escape from unprivileged containers into the host. Nebula reported the exploit was 97% reliable and completed in about five seconds during testing. Google awarded a $92,337 bounty through the kernelCTF program for the disclosure.
The upstream fix landed in April 2026, but the commit that closed GhostLock introduced a stability regression tracked as CVE-2026-53166. Fleets must apply the most recent distro point release for their kernel series, not just the first April build, to be fully covered.
No in-the-wild exploitation has been reported by CISA at time of publication. A working exploit is public through Nebula’s kernelCTF submission.
See the full write-up for patch priority guidance.
