---
id: 5566
title: "[CVE-2026-43499] IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years"
cve: CVE-2026-43499
severity: high
vendor: "Linux"
product: "Linux kernel"
affected_versions: "Linux kernel v2.6.39-rc1 through versions before v7.1-rc1; fixed in Linux 7.1"
source_domain: nebusec.ai
source_url: "https://nebusec.ai/research/ionstack-part-2/"
published_at: "2026-07-07T00:00:00Z"
tags: ["featured", "vulnerability-research", "container-security", "kernel-security", "linux", "privilege-escalation", "use-after-free", "exploitation", "linux-kernel", "container-escape", "kernelctf", "cve-2026-43499", "stack-uaf"]
phying_url: "https://phying.com/item/5566"
lang: en
---

# [CVE-2026-43499] IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years

## Summary

GhostLock (CVE-2026-43499) is a Linux kernel stack use-after-free present since 2011. NebuSec turned it into a reliable local privilege-escalation and container-escape exploit; the issue is fixed in Linux 7.1.

## Why it matters

A 15-year-old Linux kernel stack use-after-free was turned into reliable local privilege escalation and container escape, affecting essentially every unpatched major distribution.

## Intelligence Metadata

- **Sources:** nebusec.ai
- **CVE:** CVE-2026-43499
- **Vendor:** Linux
- **Product:** Linux kernel
- **Affected versions:** Linux kernel v2.6.39-rc1 through versions before v7.1-rc1; fixed in Linux 7.1
- **Published:** 2026-07-07T00:00:00Z
- **Original:** https://nebusec.ai/research/ionstack-part-2/
- **Phying News:** https://phying.com/item/5566