Kernel - GhostLock (CVE-2026-43499) Local Root Exploit

[nathany]

GhostLock (CVE-2026-43499) Local Root Exploit: Kernel Update for CloudLinux - CloudLinux

GhostLock (CVE-2026-43499) is a use-after-free bug in the Linux kernel's futex priority-inheritance code that lets any unprivileged local user become root. Its vulnerable range covers every kernel CloudLinux ships, so all supported versions are affected. There is no runtime mitigation; the fix...

blog.cloudlinux.com

 

[ARealRiley]

JOY!!!!

 

[zEitEr]

For AlmaLinux:

The fixed versions released to production are kernel-4.18.0-553.141.2.el8_10 (AlmaLinux 8), kernel-5.14.0-687.24.1.el9_8 (AlmaLinux 9), and kernel-6.12.0-211.32.1.el10_2 (AlmaLinux 10), or higher.

GhostLock (CVE-2026-43499) kernel privilege escalation: Patch released

Update: The fix is now in productionThe patched kernel for GhostLock (CVE-2026-43499) has been released to the production repositories for every affected AlmaLinux release — 8, 9, and 10. You no longer need to enable the testing repo. Just run: sudo dnf clean metadata && sudo dnf upgrade sudo...

almalinux.org