AI Tool Uncovers 15-Year-Old Linux Kernel Bug That Grants Any User Root Access

A 15-Year-Old Hole, Found by a Machine

A bug that shipped in nearly every mainstream Linux distribution since 2011 sat unnoticed for a decade and a half. It lets any logged-in user on an unpatched machine escalate straight to root, according to SecurityWeek and The Hacker News.

The flaw is tracked as CVE-2026-43499 and has been nicknamed GhostLock. It's a use-after-free bug, a class of memory-management error where a program keeps using a piece of memory after it's been freed up, letting an attacker manipulate what fills that space next.

What makes GhostLock nasty is how little it asks for. No network access. No special permissions. Just a regular logged-in session is enough, according to the same reporting.

Who Found It, and How

Nebula Security's AI-driven bug-hunting tool, VEGA, is credited with surfacing the flaw. VEGA is part of a broader 2026 wave of automated tools combing through old kernel code that human reviewers hadn't reread in years, according to SecurityWeek.

Nebula's own exploit reportedly escapes containers entirely and was 97 percent reliable in testing. Google paid out $92,337 for the discovery through its kernelCTF bug bounty program, the outlets reported.

The bug was fixed upstream in April 2026. But fixing something in the kernel source tree and getting that fix onto every machine running Linux are two very different things.

The Patch Gap

As of early July 2026, Ubuntu's own advisories still listed versions 24.04, 22.04, and 20.04 LTS as either vulnerable or with fixes still in progress, according to SecurityWeek.

That's a three-month gap between an upstream fix and full deployment across some of the most widely used Linux releases on the planet. Anyone running a server, a cloud instance, or a workstation on one of those versions without manually confirming the patched package could still be exposed.

Nebula Security has now published working exploit code for GhostLock. That's a deliberate move, and it's the kind of decision that always draws pushback.

The Fair Case Against Publishing the Exploit

There's a real argument that dropping public exploit code for a bug some distros haven't fully patched is reckless. Any attacker, skilled or not, can now grab working proof-of-concept code and go hunting for unpatched machines. Security researchers have made this exact complaint about early exploit disclosure for years, and it's not a fringe position. It's the whole reason coordinated disclosure timelines exist in the first place.

The counter, which researchers like Nebula's team generally make in these situations, is that the fix has been public and available since April. By their logic, publishing the exploit now puts pressure on the stragglers, Ubuntu included, to finish rolling out what's already been sitting in the upstream kernel for months. Whether that argument holds depends entirely on how fast the remaining patches actually land, and that's still an open question as of this week.

What Defenders Should Actually Do

SecurityWeek's reporting includes a blunt piece of advice: don't assume you're patched just because you think you should be. Confirm the specific fixed package version for your distribution rather than relying on the assumption that a routine update already covered it.

Given that Ubuntu's own advisories were still flagging multiple LTS releases as unresolved in early July, that's not a theoretical warning. It's a direct instruction from the people tracking the bug.

The Bigger Pattern

GhostLock isn't an isolated find. It's one entry in what SecurityWeek describes as a 2026 run of Linux privilege-escalation bugs turned up by AI-assisted code review, tools sifting through kernel code that hasn't had fresh human eyes on it in years.

That's arguably good news for security long-term. Old, unreviewed code is exactly where bugs like this hide. If AI tools like VEGA can find them faster than human researchers, that means more vulnerabilities getting fixed before criminal groups find them independently.

The unresolved question is basic and immediate: how many production systems running Ubuntu 24.04, 22.04, or 20.04 LTS are still sitting on the vulnerable kernel right now, three months after the fix went upstream, with working exploit code now sitting in public view.