GhostLock (CVE-2026-43499) is a Linux kernel use-after-free vulnerability introduced in version 2.6.39. It arises from a helper function designed to clean up tasks after closure, which incorrectly frees and reuses memory when a deadlock rollback occurs. The function mistakenly clears memory for a sleeping thread instead of the current task during a requeue request, leaving a dangling pointer. Exploitation allows attackers to control freed memory, achieving local privilege escalation to root and container escape. The vulnerability affected all major Linux distributions since 2011 and was patched in April 2026. Researchers disclosed technical details and exploit code, receiving a $92,337 bounty from Google's kernelCTF program.

The vulnerability allows local attackers to escalate privileges to root on affected Linux systems. It also enables container escape, breaking isolation boundaries in containerized environments. This elevates the risk of full system compromise by unauthorized users with local access. The flaw persisted for 15 years, affecting all major Linux distributions since 2011 until patched in April 2026. No known exploits in the wild have been reported at the time of disclosure.

A patch for the GhostLock vulnerability was released in April 2026. Users and administrators should apply the official Linux kernel updates provided by their distribution vendors to remediate this issue. Since this is a kernel-level vulnerability, updating to the fixed kernel version is the recommended and effective mitigation. Patch status is confirmed by the vendor advisory and public disclosures. No additional mitigations are indicated.