Security researchers at Nebula Security have uncovered a serious flaw in the Linux kernel that has been hiding in plain sight since 2011. Dubbed GhostLock and tracked as CVE-2026-43499, the bug lives in the part of the kernel that manages task scheduling priorities. An attacker who already has a regular (non-admin) account on a Linux computer can exploit this flaw to instantly become the root user — the equivalent of an administrator with unlimited access. In lab tests, the attack works reliably and takes about five seconds to run.
The flaw affects essentially every major Linux distribution released in the past 15 years, including Ubuntu, Debian, Fedora, Red Hat, and others. A fix was shipped in April 2026, but because distributions package and release kernel updates on different schedules, some systems may still be running the vulnerable version. Servers, cloud machines, and shared computers used by multiple people are especially at risk, because the attacker only needs any ordinary account to start the escalation.
How to check if you’re affected
Affected versions are Linux kernels released before the April 2026 patch (commit 3bfdc63936dd). To check your kernel version, open a terminal and run uname -r. Compare the output against your distribution’s security advisory to confirm you have the patched version. For Ubuntu, run apt list --upgradable 2>/dev/null | grep linux-image; for Red Hat/Fedora, run dnf check-update kernel. If your distribution shows an available kernel update, install it and reboot. Note that early patched builds contained a secondary crash bug (CVE-2026-53166) — verify your distribution released a version beyond the initial fix.