AI Uncovers a 15-Year-Old Linux Kernel Root Vulnerability Hidden Since 2011
Artificial intelligence has helped uncover one of the most significant Linux kernel security flaws in recent years. Security researchers at Nebula Security announced the discovery of GhostLock (CVE-2026-43499), a critical local privilege escalation vulnerability that remained hidden in the Linux kernel for approximately 15 years before being identified by the company’s AI-powered vulnerability research platform, VEGA.
The vulnerability affects Linux kernels dating back to version 2.6.39 (2011) and allows an unprivileged local user to obtain full root privileges on vulnerable systems. Its discovery not only highlights the importance of timely kernel updates but also demonstrates how AI is beginning to transform vulnerability research.
What Is GhostLock?
GhostLock is a use-after-free (UAF) vulnerability located in the Linux kernel’s futex (fast userspace mutex) implementation.
Futexes are synchronization primitives that allow user-space applications to efficiently coordinate access to shared resources while minimizing expensive kernel interactions. Because they are widely used throughout Linux, any flaw within this subsystem can have broad security implications.
According to Nebula Security, incorrect handling of the remove_waiter() function can leave behind a dangling kernel pointer that an attacker can manipulate to execute arbitrary code with kernel privileges.
A Reliable Path to Root Access
One of the reasons GhostLock has attracted so much attention is the reported reliability of the exploit.
Researchers demonstrated that an attacker with nothing more than a standard local user account can escalate privileges to root in roughly five seconds, with a reported success rate of 97% on vulnerable systems.
Unlike many kernel exploits that are unstable or require highly specific system configurations, GhostLock appears to be both practical and repeatable, making it particularly concerning for administrators.
Container Escapes Are Also Possible
The implications extend beyond traditional Linux desktops and servers.
Researchers report that GhostLock can also be used to escape containers and compromise the underlying host operating system. Because containers share the host kernel, a successful privilege escalation inside a container can potentially grant root access to the host itself.
This makes the vulnerability especially important for environments running:
Mozilla is changing Firefox’s release schedule from September, with new stable versions planned every two weeks instead of once a month. The faster release cadence will, Mozilla says, make its schedule more predictable and give “work that is ready to ship more frequent opportunities to reach users”. In a message to developers, Mozilla describes the change as an experiment it will “closely monitor” to ensure that the impact is positive and “adjust if needed”. Firefox 154, due for release on 18 August, will be the final stable version released under the current schedule. Firefox 155 is then planned for 1 […]
AppImages are designed to be simple. Download one, make it executable and run it. On Ubuntu, though, there’s an extra step: Ubuntu ships FUSE 3 by default, but some AppImages still need FUSE 2 (libfuse2t64) to run. AppManager is a new(ish) GTK4/Libadwaita app which fixes that particular annoyance by mounting AppImages through uruntime instead of FUSE. It handles the usual SquashFS-packed AppImages, plus the newer DwarFS-packed ones too. Double-click an .AppImage file and AppManager opens a macOS-style install flow. Drag the app icon to the folder and AppManager moves the file to ~/Applications, or a directory you choose, and creates the app launcher and shortcut […]
Ubuntu 26.04 LTS is prepping a bug fix update to Papers, the document viewer that replaced Evince in 25.04, resolving several annoyances – including internal PDF links that jumped to the wrong page. The internal link snafu only occurred in some PDFs, not all, and typically took you to a page one off the actual target. Annoying. The fix stops two separate bits of code that both tried to set the zoom level when links jumped to fit-width or fit-page view. A knock-on quirk also saw the alt + p shortcut (which will jump back to the previous page) wouldn’t […]
Night Light Scheduler is a new GNOME Shell extension that lets you control how warm your screen is throughout different parts of the evening (or day). GNOME’s built-in Night Light feature has a customisable schedule, and it lets you set a colour temperature that’s very orange, or less orange to filter out blue light. But that temperature holds the entire time Night Light is switched on. It eases in and out at each end but never changes in between. For most use cases, the default behaviour is fine; set and forget to a schedule. But if you wish you could […]
Ubuntu 26.10 is replacing its D-Bus implementation for the first time since 2004, swapping dbus-daemon for dbus-broker – a change end-users are unlikely to notice. Processes on your desktop talk to each other and to the host system using D-Bus, a ‘message’ bus. This is what the Ubuntu Dock uses to show unread-count badges for apps, what tells your desktop a USB drive has been plugged in, and so on. Two buses are in play. There’s aa system bus, shared across the whole device, handling hardware and background services, and a user session bus to handle desktop and app integrations […]