CVE-2026-43499: Linux Kernel — Local Privilege Escalation Risk (June 2026)

CVE-2026-43499 — Linux Kernel

CVE-2026-43499 is a high-severity vulnerability in the Linux kernel, present since 2011, that allows local attackers to escalate privileges to root and escape container boundaries. The flaw, dubbed 'GhostLock', is a use-after-free bug actively demonstrated in Google's kernelCTF program, earning a $92,337 bounty. No evidence of in-the-wild exploitation has been reported, but the risk profile is critical due to the ubiquity of affected systems.

Attack Vector

Attackers must have local access to a vulnerable Linux system. By exploiting the use-after-free condition in kernel memory management, a non-privileged user can execute arbitrary code with kernel-level permissions. This enables privilege escalation and, in containerized environments, allows escape from container isolation. The vulnerability can be triggered by crafted userland requests that manipulate kernel objects post-free, bypassing standard security boundaries.

Who Is at Risk

All major Linux distributions released since 2011 are impacted, including enterprise and cloud deployments. Google has confirmed exposure within its infrastructure, specifically in environments using unpatched kernels. Any organization running legacy or unpatched Linux kernels is at immediate risk, especially those relying on containers for workload isolation.

Patch & Mitigate

• Patch: Apply the latest Linux kernel security updates addressing CVE-2026-43499 as soon as vendor patches are available. Prioritize systems exposed to untrusted local users or running multi-tenant workloads.
• Workaround: Restrict local shell access and container deployment to trusted users only. Consider disabling unneeded local accounts until patching is complete.
• Detect: Monitor for unusual privilege escalation attempts, kernel panics, or anomalous container breakout activity. Review audit logs for suspicious userland-to-kernel interactions and unexpected process spawns with elevated privileges.

MITRE ATT&CK

• TA0004 — Privilege Escalation: The vulnerability directly enables attackers to gain root privileges from a local account.
• T1611 — Escape to Host: Exploitation allows containerized processes to break isolation and access the host system.

Source: https://www.securityweek.com/15-year-old-linux-vulnerability-ghostlock-earns-researchers-92k-from-google/