GhostLock Linux Bug Earns $92k Payout

Nebula Security disclosed GhostLock (CVE-2026-43499), a 15-year-old Linux kernel use-after-free bug that lets any logged-in user gain root control. The flaw shipped by default in every mainstream distribution since 2011. Nebula published a 97% reliable exploit that escapes containers. Google awarded $92,337 through kernelCTF. The bug was fixed in April, but patch availability remains uneven.