CVE-2026-43499

Published May 21, 2026

Last updated 12 days ago

Linux Kernel

Rtmutex

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-43499, publicly known as GhostLock, is a local privilege escalation vulnerability found within the Linux kernel. This flaw resides specifically in the `rtmutex` (real-time mutex) and Priority Inheritance (PI) futex requeue path. The core issue stems from an incorrect cleanup operation during a 'proxy-lock rollback' in the futex requeue process, where the system operates on the currently executing task instead of the true waiter task. This misdirection leaves behind stale priority-inheritance state and creates a use-after-free (UAF) condition, where the kernel attempts to use memory that has already been released. An attacker with local code execution can exploit this vulnerability to gain elevated privileges or execute unauthorized code on affected systems. The vulnerability was introduced in Linux 2.6.39 in May 2011 and affects kernels up to version 7.1.

Description: In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Modified
Products: linux_kernel

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-416

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 9

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "0C6D7D14-6525-4171-992F-7F8ADC8215B2",
            "versionEndExcluding": "6.1.175",
            "versionStartIncluding": "2.6.39",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D",
            "versionEndExcluding": "6.6.140",
            "versionStartIncluding": "6.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "55DA1C62-9991-451E-B8A8-E0004E00F789",
            "versionEndExcluding": "6.12.86",
            "versionStartIncluding": "6.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A10AC84F-C058-47D5-85B4-E6E51A613B74",
            "versionEndExcluding": "6.18.27",
            "versionStartIncluding": "6.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3",
            "versionEndExcluding": "7.0.4",
            "versionStartIncluding": "6.19",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.