Critical Linux kernel vulnerability CVE-2026-43499 (GhostLock)

CVE-2026-43499 (GhostLock) is a critical Linux kernel privilege escalation vulnerability in the RT Mutex (rtmutex) subsystem. Caused by a Use-After-Free (UAF) flaw, it existed in vulnerable kernel versions for years and allows a local unprivileged user to gain root privileges. In certain scenarios, it can also be exploited to escape from a container.

Why is this vulnerability dangerous?

If successfully exploited, an attacker may:

• gain root privileges;
• execute arbitrary code in kernel mode;
• break container isolation;
• fully compromise the affected system.

Exploitation requires only local access with a regular user account.

Affected systems

The vulnerability affects vulnerable Linux kernel versions and may be present in various Linux distributions until security updates are installed. Affected distributions include:

• Ubuntu
• Debian
• Rocky Linux
• AlmaLinux
• Fedora

Checking your kernel version

To find out the current kernel version, run the following command on your VPS/DS:

uname -r

Mitigating the vulnerability

Install the latest security updates, including the updated Linux kernel.

Ubuntu / Debian

sudo apt update
sudo apt upgrade

Rocky Linux / AlmaLinux / RHEL

sudo dnf update

For older versions:

sudo yum update

After installing the updated kernel, reboot your server:

sudo reboot

After installing the updates and rebooting, the system will use the new kernel with the latest security patches provided by your distribution's developer.

Verify the system is running the updated kernel. After the reboot, check the kernel version again:

uname -r

The reported version should match the updated kernel.