15-Year-Old Linux Vulnerability ‘GhostLock’ Earns Researchers $92k From Google
15-year-old Linux kernel vulnerability 'GhostLock' allows root access and container escapes.
A critical Linux kernel vulnerability, dubbed GhostLock (CVE-2026-43499), has been disclosed after existing for 15 years. This use-after-free flaw allows attackers to gain root privileges and has been demonstrated to enable container escapes. Researchers received a $92,337 bug bounty from Google for discovering and exploiting the vulnerability.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google?
Get an email when a new story names Google, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonGhostLock (CVE-2026-43499) is a use-after-free vulnerability that persisted undetected in the Linux kernel for 15 years, underscoring how legacy code can harbor critical security flaws across an enormous number of systems. The flaw allows attackers to escalate privileges to root and escape containerized environments, potentially compromising entire host systems and cloud workloads. This matters because Linux underpins the vast majority of servers, cloud infrastructure, and containerized applications globally, meaning the attack surface is extraordinarily wide. The $92k bug bounty payout reflects the severity and exploitability of the flaw, and highlights the critical value of proactive vulnerability research programs in surfacing issues that internal teams may miss for years.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-43499