Two 15-year-old Linux kernel flaws prompt urgent patching

Two high-severity vulnerabilities that together lay dormant in the Linux kernel for more than 15 years were publicly disclosed this week, prompting urgent patching across major distributions and cloud providers. Both were demonstrated through Google Alphabet Inc. ↗ 0.96% bug bounty programs before patches became available.

GhostLock: Root in Five Seconds

Researchers at Nebula Security disclosed GhostLock (CVE-2026-43499), a use-after-free flaw in the kernel's real-time mutex subsystem that has shipped in every mainstream Linux distribution since it was introduced in Linux 2.6.39 in May 2011. The vulnerability, which scores 7.8 on the CVSS scale, requires only ordinary local user access — no special permissions, no network access, and no unusual configuration.secure+3

The bug resides in the `remove_waiter()` function, which was reused in a context its original assumptions did not account for, leaving a dangling pointer to kernel memory exploitable for privilege escalation. Nebula says its exploit succeeds 97 percent of the time, earning the team $92,337 through Google's kernelCTF program.privacyguides+1

The fix landed upstream in April 2026 in Linux 7.1, but distribution rollout remains uneven. As of early July, Ubuntu still listed its 24.04, 22.04, and 20.04 LTS releases as vulnerable or in progress. Red Hat issued a security bulletin covering RHEL 6 through 10 and released a patched kernel for RHEL 9 on July 8. No complete workaround exists because the vulnerable code path is exercised by routine threading operations.thehackernews+3

Januscape: Escaping the Virtual Machine

Separately, security researcher Hyunwoo Kim disclosed Januscape (CVE-2026-53359), a use-after-free in KVM's shadow MMU emulation that allows a malicious guest virtual machine to break out to the host and execute code as root. Kim demonstrated the flaw as a zero-day in Google's kvmCTF program, which offers up to $250,000 for a full VM-to-host escape.securityweek+2

The vulnerable code dates to August 2010 in Linux 2.6.36 and affects both Intel and AMD architectures — the first known KVM escape to do so. A proof-of-concept that triggers a host kernel panic from inside a guest has been published, though the full escape exploit remains withheld. The flaw was patched in mainline on June 19 and backported to stable branches by July 4.cybernews+4

Cloud Providers on Alert

Cloud operators face the more acute threat from Januscape. "An attacker who has rented just a single instance on a public cloud could panic the host kernel to take down every other tenant VM on the same physical machine, or run code with root privilege on the host to take over the host and all the guests on it," Kim wrote in his advisory. Organizations unable to patch immediately are advised to disable nested virtualization or restrict permissions on `/dev/kvm`, which is world-writable by default on RHEL 8 and later.cloudlinux+3