> ## Content Index
> Fetch the complete content index at: https://www.privacyguides.org/llms.txt
> Use this file to discover other available public pages before exploring further.

# 15-Year-Old Linux Kernel Vulnerability Allows Full System Takeover
- URL: https://www.privacyguides.org/news/2026/07/08/15-year-old-linux-kernel-vulnerability-allows-full-system-takeover/
- Published: 2026-07-08T22:40:15.000Z
- Updated: 2026-07-08T22:40:15.000Z
- Description: Researchers at Nebula Security discovered a privilege escalation bug in the Linux kernel that's been lying dormant for over 15 years that affects every Linux distribution before version 7.1.
- Author: Fria Reyes
- Tags: News Briefs

Researchers at [Nebula Security](https://nebusec.ai/research/ionstack-part-2/) discovered a privilege escalation bug in the Linux kernel that's been lying dormant for over 15 years that affects every Linux distribution before version 7.1.

Dubbed "GhostLock," the vulnerability was originally introduced in Linux 2.6.39 in a [rework](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8161239a8bcc) of `rtmutex` from 2011, over 15 years ago. The bug allows an attacker to gain full root permissions and even break out of containers starting from an unprivileged user. It was [fixed](https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3bfdc63936dd4773109b7b8c280c0f3b5ae7d349) in April 2026 in Linux version 7.1.

Nebula says all Linux distributions before the patch are affected, so make sure to update your system to the latest stable version available from your distribution.

The researchers were able to reliably exploit the vulnerability 97% of the time and were awarded $92,337 by Google through kernelCTF. 

The bug lies in the `remove_waiter()` function. It was written to address the situation where a thread blocks on its own and then cleans up after itself. However, the `rt_mutex_start_proxy_lock()` function used it to clean up a different, sleeping thread.

Under the right conditions, `remove_waiter()` will remove the pointer for the currently executing task instead of the waiting task, leaving a dangling pointer to kernel memory that can be exploited to escalate privileges.

Effectively, the function was used for a purpose it wasn't originally written for and the assumptions it was originally written with caused the bug.

The researchers were also able to bypass [address space layout randomization](https://en.wikipedia.org/wiki/Address%5Fspace%5Flayout%5Frandomization) (ASLR), a security feature meant to protect against memory corruption vulnerabilities, by timing the `prefetch` on a given address.

> A `prefetch` on a given address runs in a different number of cycles depending on whether that address is mapped in the current page tables, so an unprivileged process can time `prefetch` across the kernel range and read off which addresses are mapped (the [prefetch paper](https://gruss.cc/files/prefetch.pdf) has the details).

> It works here as Linux barely randomizes the base of its default kernel image (\~9 bits of entropy for text base), so a little averaging can recover the KASLR base with near 100% reliability.

Likely there are plenty of other similar bugs hiding in the massive Linux codebase.

[Google](https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html) estimates that around 76% of vulnerabilities in Android were memory safety vulnerabilities before they began their push for memory-safe languages like Rust, with the number dwindling down to 24% (and that was back in 2024).

The Linux kernel could benefit from higher adoption of [Rust](https://rust-for-linux.com) in the kernel. Making use of hardware features such as [MTE](https://developer.android.com/ndk/guides/arm-mte) for ARM chips and the upcoming [ChkTag](https://community.intel.com/t5/Blogs/Tech-Innovation/open-intel/ChkTag-x86-Memory-Safety/post/1721490) for x86 chips will be huge in protecting from memory safety vulnerabilities in the future as well.