CVE-2026-43499Disclosure(linux / linux_kernel)

CRITICALCVSS 7.8 · HIGH

Exploitation observed; activity peaked at 27 mentions and remains active

Immediate actions

Patch linux linux_kernel systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]

linux CVEs Back to dashboard

8.5/ 10 priority

Sources & remediation

Patch / fix

Other references

Weakness type (CWE)

CWE-416

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

linux_kernel

Threat summary

Active exploitation appears in 5 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
163 mentions across 50 observed days

What's happening

Active exploitation reported across 5 signals
Exploit tool or code specified in 44 signals
PoC mentioned or linked in 63 signals
Patch or workaround mentioned in 49 signals
Technical details provided in 84 signals
Disclosure: 37 classified signals
General: 33 classified signals
Peaked 45d ago at 27 mentions (2026-07-08); latest day: 1
163 total mentions across 50 days

Affected systems

Vendors

linux

Products

linux_kernel

Deep dive

Activity timeline163 mentions / 50d

Signal classification6 categories

Disclosure

3723.3%

General

3320.8%

PoC

3320.8%

Patch

2616.4%

Exploit

2515.7%

Active Exploitation

53.1%

Referenced assets92 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-21	1	Patch1
2026-06-25	4	Active Exploitation1Disclosure1General2
2026-06-27	2	Exploit1PoC1
2026-07-02	1	Disclosure1
2026-07-08	27	Active Exploitation1Disclosure7Exploit5General4Patch3PoC7
2026-07-09	16	Disclosure6Exploit2General2Patch4PoC2
2026-07-10	10	Disclosure4General3Patch2PoC1
2026-07-11	6	Active Exploitation1Disclosure2General2Patch1
2026-07-12	2	Disclosure1Patch1
2026-07-13	8	Disclosure5General1Patch2
2026-07-14	5	General1Patch4
2026-07-15	5	Exploit1General1Patch2PoC1
2026-07-16	2	Active Exploitation1Disclosure1
2026-07-17	2	Disclosure1PoC1
2026-07-18	2	General1Patch1
2026-07-19	3	Disclosure1General1PoC1
2026-07-20	2	Disclosure1PoC1
2026-07-21	2	Disclosure1Patch1
2026-07-22	1	Disclosure1
2026-07-23	4	General2PoC2
2026-07-25	1	General1
2026-07-26	1	PoC1
2026-07-27	3	Exploit1PoC2
2026-07-29	4	Disclosure1Exploit2PoC1
2026-07-30	5	General3Patch2
2026-07-31	5	Active Exploitation1Exploit2General1PoC1
2026-08-01	3	Exploit1PoC2
2026-08-02	3	Disclosure1PoC2
2026-08-03	4	Exploit3Patch1
2026-08-04	3	Disclosure1Exploit1Patch1
2026-08-06	2	Exploit1PoC1
2026-08-08	1	Disclosure1
2026-08-11	3	Exploit2PoC1
2026-08-16	1	PoC1
2026-08-17	1	Exploit1
2026-08-20	1	General1
2026-08-25	2	Exploit1General1
2026-08-26	1	PoC1
2026-08-27	1	Exploit1
2026-09-01	1	General1
2026-09-05	2	General1PoC1
2026-09-07	1	General1
2026-09-09	1	General1
2026-09-12	2	PoC2
2026-09-18	1	General1
2026-09-25	1	General1

Full discourse20 posts

Nebula Security@nebusecurity92d
Exploit
GhostLock (CVE-2026-43499) is a 15yr old kernel 0-day we used in IonStack full chain exploit. Everything around you, as long as it runs Linux, from IoT to mobile to desktop, is affected. Read how we won $92,337 bug bounty with GhostLock and see our exploit on Github. Link below https://t.co/WB42YSBUWj
Post summary
The tweet announces the GhostLock kernel zero‑day (CVE-2026-43499), shares a GitHub exploit, cites a $92,337 bug bounty win, and warns that all Linux devices are affected.
2120324997586149.4K
7.2K followersView on X
Alessandro Paluzzi@alex193a66d
PoC
Inspired by 'Root My Galaxy', here is Root My Pixel: an #Android app that leverages #CVE-2026-43499 to get temporary one-tap root access with ReSukiSU. But, as you can see in the video, it took almost 10 minutes to complete the process, including one failed attempt along the way. https://t.co/YJqt8N9176
Post summary
The tweet showcases a new Android app demonstrating exploitation of CVE-2026-43499 to gain temporary root via ReSukiSU, serving as a proof‑of‑concept.
3759458942863.8K
61.1K followersView on X
b33f | 🇺🇦✊@FuzzySec71d
PoC
Quick POC using @nebusecurity CVE-2026-43499 to root my bootloader locked US S25 (SM-S931U1). Btw this works on latest fw. This phone is Android 16, June update. https://nebusec.ai/research/ionstack-part-2/ I have detailed notes on flashing, exploitation, offset finding etc, blog post later 🖖 https://t.co/Gr7vN3NRCm
Post summary
A user shares a quick proof‑of‑concept for CVE‑2026‑43499, referencing external research and outlining exploitation steps for a specific device.
1465146219961.9K
33.5K followersView on X
The Hacker News@TheHackersNews92d
Exploit
🛑 A newly found 15-year-old #Linux kernel flaw, GhostLock (CVE-2026-43499), could let any logged-in user gain root on unpatched distributions. A working exploit code is now public, and it escaped containers in tests. Read details here: https://thehackernews.com/2026/07/15-year-old-ghostlock-flaw-enables-root.html
Post summary
The passage states that the 2026‑43499 GhostLock kernel flaw enables privilege escalation and that a working exploit is publicly available, but it does not report active exploitation or a patch.
998632311071.2K
2.3M followersView on X
Rıdvan Yağlı@ridvanyagli70d
General
🔴 İddiaya göre FuzzySec adlı araştırmacı, Nebu Security'nin CVE-2026-43499 açığını kullanarak bootloader kilitli ABD modeli Samsung Galaxy S25 (SM-S931U1) üzerinde root yetkisi elde etmeyi başardı. Telefonu Android 16 ve Haziran güncellemesi var. https://t.co/pN9zo5c502
Post summary
The tweet reports that a researcher (FuzzySec) reportedly exploited CVE‑2026‑43499 to gain root on a locked‑bootloader Samsung Galaxy S25 running Android 16, but no PoC, exploit code, or mitigation details are provided.
134129316626.4K
2.3K followersView on X
Nebula Security@nebusecurity65d
Exploit
Here's the final chapter of our IonStack series, the Android rooting part. Including how we use GhostLock (CVE-2026-43499) to defeated KASLR on Android and bypassed KCFI to get arbitrary kernel memory read and write: https://nebusec.ai/research/ionstack-part-3
Post summary
The post announces the use of GhostLock (CVE‑2026‑43499) to defeat KASLR and bypass KCFI on Android, detailing the exploit without indicating active exploitation or a patch.
43931789426.4K
7.2K followersView on X
0xor0ne@0xor0ne69d
PoC
Exploiting a Linux kernel Stack UAF (GhostLock, CVE-2026-43499) (@nebusecurity) https://nebusec.ai/research/ionstack-part-2/ #infosec https://t.co/tWzL3vJiEB
Post summary
The tweet announces a Stack UAF vulnerability (GhostLock, CVE‑2026‑43499) and links to a research page that likely contains a proof‑of‑concept, but offers no evidence of real‑world exploitation or a patch.
1290178887.5K
94.3K followersView on X
🛡VAHID NAMENI@vahidnameni87d
Disclosure
آسیب‌پذیری GhostLock که توسط AI بعد از ۱۵ سال کشف شد، فقط طی چندثانیه می‌توان دسترسی root گرفت و حتی از container خارج شد! از منظر دفاعی، شناسایی آن نه اینکه سخت باشد ولی چون معمولا، بین SecOps و StorageOps هماهنگی وجود ندارد، شناسایی نمی‌شود. https://nebusec.ai/buglist/CVE-2026-43499/ https://t.co/I5UIkHE1GY
Post summary
GhostLock (CVE-2026-43499) is highlighted as a recently discovered vulnerability that enables rapid root access and container escape, but no PoC, exploit code, patch, or active exploitation information is provided.
015015311313.6K
4.5K followersView on X
Md Ismail Šojal 🕷️@0x0SojalSec69d
Active Exploitation
Bootloader-locked US Galaxy S25 just got rooted, this guy used Nebu Security’s CVE-2026-43499 to gain full root on SM-S931U1 Running Android 16 with the June 2026 patch. https://t.co/4FZ88StyyF
Post summary
The tweet reports a real-world exploitation of Nebu Security CVE-2026-43499 that granted full root on a bootloader-locked Galaxy S25 running the latest patch.
32121717814.0K
57.3K followersView on X
Nebula Security@nebusecurity105d
Disclosure
"IonStack" is chained with two 0-days: CVE-2026-10702 and CVE-2026-43499. CVE-2026-10702 is a Firefox 0-day. At its core, it was an instruction-modeling flaw buried deep inside IonMonkey, Firefox’s highly complex JIT compiler. Even after Mythos’s extensive audits, the bug was still missed. This is the first publicly disclosed JIT vulnerability since then. We were able to uncover the vulnerability and turn it into a highly stable exploit with a nearly 100% success rate, ultimately achieving remote arbitrary code execution in Firefox. CVE-2026-43499 is a universal Linux kernel LPE vulnerability that has lived in the kernel tree for 15 years since v2.6.38 and affects every distribution: desktop, server, Android, and embedded. It does not require any special kernel modules; CONFIG_FUTEX_PI is all it needs, and to our knowledge, it’s enabled across all distributions we researched. The bug primitive is a UAF in stack caused by a race condition. Turning it into a reliable LPE takes several stack tricks, but eventually it becomes very stable. We measured 10/10 successful privilege escalations on Linux 6.12, along with a high success rate on Android. We will write a series of blog posts disclosing both 0-days used in “IonStack”. The first post is coming soon. Stay tuned.
Post summary
The post announces two newly discovered 0‑day CVEs (CVE‑2026‑10702 and CVE‑2026‑43499), details their technical aspects and high exploit success rates, and signals upcoming blog‑post disclosures.
42511507513.2K
6.7K followersView on X
0xor0ne@0xor0ne52d
Exploit
Analysis and exploitation of GhostLock (CVE-2026-43499) (@nebusecurity) https://nebusec.ai/research/ionstack-part-2/ https://nebusec.ai/research/ionstack-part-3/ #infosec https://t.co/Y3Vg9VP3Fn
Post summary
The tweet references research that includes analysis and exploitation of GhostLock (CVE-2026-43499), providing links to detailed content but not explicitly detailing patches or confirming active exploitation in the wild.
0120149768.4K
94.3K followersView on X
Linux Kernel Security@linkersec58d
Exploit
IonStack part III: Rooting Android 17 with GhostLock Article about adapting the exploit of CVE-2026-43499 (kernel stack UAF) to Android. The researchers used KernelSnitch, ashmem fops overwriting, pipe_buffer corruption, and other tricks to perform LPE. https://nebusec.ai/research/ionstack-part-3/ https://t.co/xeo9KCmRIJ
Post summary
Researchers adapted CVE-2026-43499, a kernel stack use‑after‑free, to root Android 17 using KernelSnitch and related techniques, demonstrating a functional local privilege escalation PoC.
0250116615.1K
10.6K followersView on X
Rıdvan Yağlı@ridvanyagli92d
Exploit
🔴 15 yıllık Linux çekirdeği 0-day açığı GhostLock (CVE-2026-43499) kamuoyuna açıklandı. Nebula Security adlı siber güvenlik şirketi, GhostLock adını verdikleri ve yaklaşık 15 yıldır Linux çekirdeğinde bulunduğu belirtilen güvenlik açığını, IonStack tam saldırı zincirinde kullandıklarını açıkladı. Şirket bu açık sayesinde 92.337 dolar bug bounty ödülü kazandıklarını duyurdu. Araştırmacılara göre bu güvenlik açığı; Linux tabanlı IoT cihazları, mobil cihazlar, masaüstü sistemler ve diğer birçok platformu etkiliyor. Use-After-Free (UAF) tipi bir yerel ayrıcalık yükseltme açığı olduğu için önemlidir. Açığa ilişkin PoC ve exploit GitHub üzerinden yayınlandı. PoC ve Exploit: https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499
Post summary
The announcement reveals CVE-2026-43499 as a UAF local privilege escalation in Linux, includes a publicly available PoC and exploit on GitHub, but provides no evidence of active exploitation or patch guidance.
21201107710.3K
2.2K followersView on X
bearstech@bearstech85d
General
Un bel article qui détaille GhostLock (CVE-2026-43499) : une vulnérabilité du noyau Linux présente depuis 2011 dans quasi toutes les distributions Linux. 👉 https://nebusec.ai/research/ionstack-part-2/ https://t.co/8UNSm7MHTl
Post summary
The tweet cites an article that outlines the GhostLock kernel flaw (CVE‑2026‑43499), highlighting its longstanding presence across Linux distributions, but gives no PoC, exploit, or patch details.
1270101588.4K
18.8K followersView on X
TryHackMe@tryhackme81d
PoC
Nothing says “relaxing Sunday” like exploiting a Linux futex PI kernel flaw. GhostLock: CVE-2026-43499 is now live 👻 ▶️ https://tryhackme.com/room/ghostlockcve202643499?utm_source=twitter&utm_medium=social&utm_campaign=ghostlock https://t.co/Pgof4sw0kn
Post summary
The tweet announces the availability of a Proof of Concept for the GhostLock kernel flaw (CVE-2026-43499) via a TryHackMe training room.
11401312611.3K
310.0K followersView on X
Nicolas Krassas@Dinosn80d
PoC
linuxoid-cn/cve-2026-43499-poc-analysis: Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only. https://github.com/Linuxoid-cn/CVE-2026-43499-Poc-Analysis
Post summary
The text announces a PoC for CVE-2026-43499 on Xiaomi devices, providing a GitHub link for analysis, with no exploitation or patch information.
119095477.1K
160.8K followersView on X
OS開発者@hacker_infra92d
Disclosure
RHEL系はRHEL6からAlma10まで影響うける Ubuntu系は影響を受ける緩和策はないね。Red hat のcve databaseが変更になって影響有りになった・・・。 https://access.redhat.com/security/cve/cve-2026-43499 https://ubuntu.com/security/CVE-2026-43499 https://nebusec.ai/research/ionstack-part-2/
Post summary
CVE-2026-43499 impacts RHEL (6 through AlmaLinux 10) and Ubuntu; there are no mitigations, and official CVE pages are cited.
0292725414.4K
2.9K followersView on X
The Hacker News@TheHackersNews89d
Active Exploitation
In case the algorithm had other priorities... GhostLock vulnerability is risky because of how it can be chained. By itself, CVE-2026-43499 needs local access. Nebula says it used the bug after a Firefox-on-Android flaw, turning one tap on a malicious link into full root control.
Post summary
CVE-2026-43499, which requires local access, has reportedly been exploited in the wild by chaining with a Firefox–on–Android flaw, enabling root control from a single malicious link.
32321012339.3K
2.3M followersView on X
Daily CyberSecurity@Daily_CyberSec92d
PoC
Researchers disclosed GhostLock (CVE-2026-43499) with public PoC code. The 15-year Linux kernel bug enables privilege escalation and container escape. #GhostLock #CVE202643499 #LinuxKernel #PrivilegeEscalation #ContainerEscape #InfoSec http://securityonline.info/ghostlock-cve-2026-43499/
Post summary
Researchers disclosed CVE-2026-43499, providing a public PoC that demonstrates a 15‑year‑old Linux kernel privilege escalation and container escape vulnerability, with no mention of active exploitation or patches.
119073306.1K
12.9K followersView on X
7h3h4ckv157@7h3h4ckv15767d
Disclosure
Researchers at Nebula Security have disclosed GhostLock, a 15-year-old Linux kernel flaw that lets any logged-in user take full root control of a machine that has not been patched. CVE-2026-43499 Source/Read: https://thehackernews.com/2026/07/15-year-old-ghostlock-flaw-enables-root.html?m=1 https://t.co/du4GrddySr
Post summary
Nebula Security discloses a 15‑year‑old Linux kernel flaw (GhostLock) that enables privilege escalation to root, but no PoC, exploit, patch, or active exploitation is reported.
011066314.3K
57.1K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	linux	linux_kernel	-	-	-

Explore more

Back to dashboard linux CVEs linux_kernel vulnerabilities

What researchers are saying

CVE-2026-43499

Nebula Security[verified]@nebusecurityExploit

The tweet announces the GhostLock kernel zero‑day (CVE-2026-43499), shares a GitHub exploit, cites a $92,337 bug bounty win, and warns that all Linux devices are affected.

b33f | 🇺🇦✊[verified]@FuzzySecPoC

A user shares a quick proof‑of‑concept for CVE‑2026‑43499, referencing external research and outlining exploitation steps for a specific device.

Rıdvan Yağlı[verified]@ridvanyagliGeneral

The tweet reports that a researcher (FuzzySec) reportedly exploited CVE‑2026‑43499 to gain root on a locked‑bootloader Samsung Galaxy S25 running Android 16, but no PoC, exploit code, or mitigation details are provided.

Nebula Security[verified]@nebusecurityExploit

The post announces the use of GhostLock (CVE‑2026‑43499) to defeat KASLR and bypass KCFI on Android, detailing the exploit without indicating active exploitation or a patch.

0xor0ne[verified]@0xor0nePoC

The tweet announces a Stack UAF vulnerability (GhostLock, CVE‑2026‑43499) and links to a research page that likely contains a proof‑of‑concept, but offers no evidence of real‑world exploitation or a patch.

🛡VAHID NAMENI[verified]@vahidnameniDisclosure

GhostLock (CVE-2026-43499) is highlighted as a recently discovered vulnerability that enables rapid root access and container escape, but no PoC, exploit code, patch, or active exploitation information is provided.

Md Ismail Šojal 🕷️[verified]@0x0SojalSecActive Exploitation

The tweet reports a real-world exploitation of Nebu Security CVE-2026-43499 that granted full root on a bootloader-locked Galaxy S25 running the latest patch.

Nebula Security[verified]@nebusecurityDisclosure

The post announces two newly discovered 0‑day CVEs (CVE‑2026‑10702 and CVE‑2026‑43499), details their technical aspects and high exploit success rates, and signals upcoming blog‑post disclosures.