Vulnerability Summary

GhostLock (CVE‑2026‑43499) gives a local, non‑privileged attacker a three‑stage primitive: a dangling pointer into kernel stack memory, a constrained write to an almost‑arbitrary address, and finally full control‑flow hijack that can be turned into root privileges or container escape. The bug exists in every Linux distribution that ships kernels from v2.6.39‑rc1 to v7.1‑rc1 and requires only the CONFIG_FUTEX_PI=y option – no special capabilities or namespaces are needed[1].

Root Cause

The flaw lives in remove_waiter() of kernel/locking/rtmutex.c. The function was written for the simple case where the current thread is also the waiter, so it clears current->pi_blocked_on. When the rtmutex code later proxies a waiter via rt_mutex_start_proxy_lock() (used by FUTEX_CMP_REQUEUE_PI), current is the requeuer, not the sleeping thread. The rollback path mistakenly clears the requeuer’s pi_blocked_on, leaving the original waiter’s pi_blocked_on pointing at its own stack frame, which is freed when the thread returns to userspace[1][2].

Triggering the Stack‑UAF

An attacker creates a three‑thread PI futex cycle that forces rt_mutex_start_proxy_lock() to return ‑EDEADLK. The kernel then executes the buggy remove_waiter() and the waiter’s pi_blocked_on becomes a dangling pointer into its stack frame. Because the stack memory is released, the attacker can later reclaim it with a carefully crafted syscall that writes into the same stack depth – prctl(PR_SET_MM_MAP, …) works because it copies a user‑supplied auxv into a fixed stack buffer that lands over the freed frame[1].

Exploit Primitives

Re‑using the stack allows the attacker to forge a fake rt_mutex_waiter. The fake object is shaped so that the subsequent rt_mutex_dequeue() (an rb‑tree erase) performs a single constrained write: *(u64 *)target = W0_BASE. The constraints require the dword before target to be zero (unlocked spinlock) and the following fields to be benign, which the attacker satisfies by targeting the writable inet6_protos[IPPROTO_UDP] table in the direct‑mapped kernel address space[1]. Overwriting that function pointer redirects a loopback IPv6 UDP packet to attacker‑controlled code.

From Write to Root

With the kernel image base leaked via a prefetch‑based KASLR side‑channel[2], the attacker knows the direct‑map address of the CPU entry area (CEA). The CEA provides ~120 bytes of controllable memory that can host the fake waiter, a fake inet6_protocol structure, and a short ROP chain. The ROP pivots to the CEA and flips the mode field of the core_pattern sysctl, making it world‑writable. An unprivileged process then writes a core‑pattern that spawns a setuid‑root shell on any crash, completing the privilege escalation.

Business Impact

Because the bug affects all mainstream distributions released in the last 15 years, any legacy production fleet that has not been upgraded to kernel 7.1 or later is vulnerable. The exploit requires only standard threading syscalls, so containerized workloads, CI runners, or developer laptops are all potential entry points. Organizations must audit kernel versions, apply the upstream patch, and consider enabling RANDOMIZE_KSTACK_OFFSET to mitigate the stack‑reuse step. The cost of patching is low (kernel update), but the risk of silent privilege escalation in multi‑tenant environments is high, especially for cloud providers that still run older LTS kernels for stability.

Mitigation Checklist

  • Upgrade to kernel 7.1‑rc1 or newer.
  • Enable CONFIG_RANDOMIZE_KSTACK_OFFSET to randomize stack locations.
  • Verify CONFIG_FUTEX_PI usage and consider restricting unprivileged futex requeues.
  • Monitor for abnormal prctl(PR_SET_MM_*) usage in audit logs.