Updated: 2026-07-14 (#2)
Updated: 2026-07-14 (#1)
Updated: 2026-07-09
Date: 2026-07-08
GhostLock (CVE-2026-43499) is a use-after-free vulnerability in the Linux kernel’s rtmutex subsystem, which can be abused for privilege escalation. It is extensively described at [R 1]. A public PoC has proven to work, there’s a public root exploit for at least android.
EGI SVG ID : EGI-SVG-2026-31
CVE ID : CVE-2026-43499
CVSSv3 Score:
Sites are required to update as soon as possible the Linux kernel on hosts giving access to unprivileged users, e.g. grid worker nodes, but also container hosts, notebook servers and CI runners.
At the time of writing, fixed kernels are available for only some of the relevant distributions. Please check the references listed at the bottom of this advisory for your distribution(s), update and reboot affected systems as soon as feasible.
In the meantime sites might want to deny unprivileged users access to affected resources. To our knowledge there is no other mitigation.
TLP:CLEAR information - Unlimited distribution
https://advisories.egi.eu/Advisory-EGI-SVG-2026-31
https://advisories.egi.eu/Advisory-SVG-CVE-2026-43499
Minor updates may be made without re-distribution to the sites.
This advisory is subject to the Creative Commons licence
https://creativecommons.org/licenses/by/4.0/ and
the EGI (https://www.egi.eu/) Software Vulnerability Group
must be credited. -----------------------------
Comments or questions should be sent to svg-rat at mailman.egi.eu
Vulnerabilities relevant for EGI can be reported at report-vulnerability at egi.eu
(see [R 99] for further details, and other information on SVG)
SVG was alerted to this vulnerability by Laurent Caillat-Vallet (EGI CSIRT)