Skip to content

OSG-SEC-2026-07-08 Linux Kernel rtmutex Local Privilege Escalation (CVE-2026-43499)

Linux Kernel rtmutex Local Privilege Escalation (CVE-2026-43499)

Dear OSG Security Contacts,

A 15 year old Linux kernel vulnerability has been identified in the real-time mutex (rtmutex) subsystem (CVE-2026-43499), also referred to as GhostLock.
The vulnerability may allow an unprivileged local user to exploit a use-after-free condition in the kernel, potentially resulting in privilege escalation or arbitrary code execution or DoS on affected systems.
Because the flaw affects a core Linux kernel component, a broad range of Linux systems may be impacted.

WHAT ARE THE VULNERABILITIES:

The vulnerability is caused by a use-after-free condition in the Linux kernel's rtmutex subsystem during specific futex operations. Under certain conditions, the kernel may continue accessing memory after it has been released, leading to memory corruption.
A publicly available proof-of-concept demonstrates that an unprivileged local user can exploit the vulnerability to obtain elevated privileges on affected systems. The vulnerability affects default kernel configurations and does not require unusual system settings or special capabilities to trigger.
The public exploit code is specific to Android and causes a crash, not privilege escalation; however, the availability of public exploit code significantly lowers the barrier to exploitation.

IMPACTED VERSIONS:

The vulnerability affects Linux systems running kernel versions that include the vulnerable rtmutex code. The following Red Hat Enterprise Linux releases are affected:

  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux 10

Ubuntu, Debian, Rocky Linux, AlmaLinux, SUSE, and other Linux distributions may also be affected depending on the kernel package version and vendor backports.
Security updates are already available for some Debian releases, while others remain vulnerable until updated packages are installed.

Administrators should consult their respective Linux distribution vendor to determine whether installed kernel packages are affected and whether security updates are available.

WHAT YOU SHOULD DO:

Apply vendor-provided kernel updates addressing CVE-2026-43499 when they become available. A system reboot is required after installing the updated kernel for the changes to take effect.
Because this vulnerability affects built-in Linux kernel code, there is currently no complete mitigation that eliminates exposure prior to patching.
Systems that provide local access to untrusted users should be prioritized for kernel updates.
Continue to monitor your Linux distribution vendor for additional security advisories and updated kernel packages.

REFERENCES

[1] https://www.cve.org/CVERecord?id=CVE-2026-43499
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-43499
[3] https://access.redhat.com/security/cve/cve-2026-43499
[4] https://nebusec.ai/research/ionstack-part-2/
[5] https://security-tracker.debian.org/tracker/CVE-2026-43499
[6] https://ubuntu.com/security/CVE-2026-43499

Please contact the OSG security team at [email protected] if you have any questions or concerns.

OSG Security Team