Notice of the Linux Kernel rtmutex UAF Local Privilege Escalation/Container Escape Vulnerability (CVE-2026-43499)
Recently, a local privilege escalation vulnerability that had remained latent for 15 years was disclosed in the Linux kernel. The vulnerability ID is CVE-2026-43499, known as GhostLock. This vulnerability resides in the real-time mutex (rtmutex) subsystem of the Linux kernel. A local low-privilege attacker can exploit a race condition in the futex subsystem to obtain a dangling pointer, which can then be leveraged to escalate privileges locally and escape containers on affected systems.
Description
| Type | CVE-ID | Severity | Discovered |
|---|---|---|---|
| Local privilege escalation and container escape | High | 2026-07-08 |
Impact
CVE-2026-43499 is a local privilege escalation vulnerability in the Linux kernel rtmutex and priority inheritance (PI) futex requeue path. The root cause lies in remove_waiter() in kernel/locking/rtmutex.c. When futex_requeue() invokes rt_mutex_start_proxy_lock() to perform a proxy lock for other threads and enters the rollback path upon failure, the legacy code incorrectly treats the current task as the task to which the waiter belongs. As a result, pi_blocked_on of the waiter thread is not cleared. This leaves a dangling pointer to rt_mutex_waiter on the kernel stack, which can then lead to a use-after-free (UAF) vulnerability.
Affected kernel versions:
- 2.6.39 ≤ Linux Kernel < 6.1.175
- 6.2 ≤ Linux Kernel < 6.6.140
- 6.7 ≤ Linux Kernel < 6.12.86
- 6.13 ≤ Linux Kernel < 6.18.27
- 6.19 ≤ Linux Kernel < 7.0.4
Nodes in CCE clusters running CentOS 7.6, Huawei Cloud EulerOS 2.0, EulerOS 2.9, and EulerOS 2.10 are affected by this vulnerability.
Mitigation
In the custom seccomp profile of the container workload, intercept the specific futex operations (such as FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI) that trigger the vulnerability. For details, see Restrict a Container's Syscalls with seccomp.
The following is an example of the seccomp configurations:
"syscalls": [
{
"names": [
"futex"
],
"action": "SCMP_ACT_ERRNO",
"args": [
{
"index": 1,
"op": "SCMP_CMP_MASKED_EQ",
"value": 127,
"valueTwo": 11
}
]
},
{
"names": [
"futex"
],
"action": "SCMP_ACT_ERRNO",
"args": [
{
"index": 1,
"op": "SCMP_CMP_MASKED_EQ",
"value": 127,
"valueTwo": 12
}
]
}
] 
CCE functions do not rely on the preceding seccomp configurations. Ensure that the configurations are fully validated a testing environment before implementation.
Solution
For Huawei Cloud EulerOS 2.0, CCE and related teams will release new OS versions to fix the vulnerability. Stay tuned for updates on OS Image Tag Release Notes.
CentOS 7.6, EulerOS 2.9, and EulerOS 2.10 have reached EOS. Use Huawei Cloud EulerOS 2.0 instead.
Once an OS image with the vulnerability fixed is released, new clusters and nodes will have the vulnerability fixed by default. To fix the vulnerability on existing nodes, you can simply reset them. If the cluster version has reached EOS, you need to upgrade the version first.
