AI Agent Discovers 15-Year-Old Linux Kernel Privilege Escalation Bug Named GhostLock

Researchers at Nebula Security have identified GhostLock, a Linux kernel vulnerability tracked as CVE-2026-43499 that has been present since Linux 2.6.39 in 2011.

The flaw allows attackers with local access to escalate privileges to root on nearly all major Linux distributions released since that time. Linux kernel version 7.1 includes a fix for the issue, but currently, the only practical precaution is to install the updated kernel.

The vulnerability was discovered by Nebula Security's AI agent VEGA, and Google awarded a $92,337 bug bounty through its kernelCTF program. During testing, the exploit worked successfully 97 percent of the time.

What GhostLock Does and Which Linux Systems Are Affected

GhostLock is a local privilege escalation vulnerability that allows an attacker with access to a system to potentially gain full root privileges and take complete control.

The flaw stems from a helper function within the Linux kernel's scheduling system, responsible for cleaning up tasks after they finish. When a deadlock occurs and a rollback is initiated, the function can free memory while another task still holds a reference to it. This situation creates a use-after-free condition that attackers can exploit.

The vulnerability is present in Linux kernel versions from 2.6.39, released in 2011, up to Linux 7.0, and affects nearly all major Linux distributions released since 2011. It impacts both server and desktop Linux systems, particularly those where an attacker has already established some level of local access.

Given its 15-year history, GhostLock has been a persistent issue, affecting the vast majority of Linux systems deployed worldwide over that period.

Why Only a Patched Kernel Fixes It and What Users Should Do

There is currently no practical workaround or mitigation for GhostLock. Nebula Security has stated that the only reliable solution is installing the patched kernel.

Users and administrators of affected systems should verify their current kernel v…