We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·25d ago·5 min read
GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years
TL;DR
GhostLock (CVE-2026-43499) is a critical stack-based use-after-free vulnerability in the Linux kernel that has persisted for over 15 years. Discovered by VEGA, it allows unprivileged local attackers to escalate privileges and escape containers with a 97% success rate.
✦ Why It Matters
Upgrade all Linux distributions to the latest LTS version to protect against the GhostLock vulnerability.
Key Takeaways
- Identify all systems running affected Linux kernel versions.
- Implement immediate upgrades to the latest LTS kernel.
- Conduct security assessments to identify potential exploit vectors.
- Stay informed about ongoing vulnerabilities and patches in the Linux ecosystem.
Full Summary
GhostLock is a vulnerability in the Linux kernel that has existed since version 2.6.39 and affects all major distributions without the patch. It allows unprivileged local attackers to exploit a stack-based use-after-free (UAF) condition, leading to privilege escalation and potential container escape.
The vulnerability was demonstrated to be 97% stable in its exploitability, prompting a significant reward from Google for its discovery. The issue has been present for over 15 years, emphasizing the importance of maintaining updated kernel versions.
Engineers and system administrators should prioritize upgrading to the latest Long-Term Support (LTS) versions to mitigate this risk. The findings underscore the need for continuous security assessments in software development and deployment.