GhostLock (CVE-2026-43499): The 15-Year-Old Kernel Bug That Hands Anyone Root

A working proof-of-concept for CVE-2026-43499 , nicknamed GhostLock, went public on July 7, 2026. It hands any unprivileged local user a root shell in about five seconds, and it works from inside a container to escape to the host. If you run Linux servers — shared hosting, VPS, or bare metal — this is the one to patch before anything else this week. What GhostLock is The bug lives in…