AI Tool Finds 15-Year-Old Linux Kernel Bug
7 reported
According to a Wired report, security firm Nebula Security published exploit code for a vulnerability in the Linux kernel that went undetected for 15 years. The bug, designated CVE-2026-43499 and named GhostLock, is a use-after-free flaw that allows any logged-in user to gain root access on an unpatched machine. Nebula discovered the vulnerability using VEGA, its AI-driven bug-hunting tool, as part of a 2026 effort to surface flaws in old kernel code. The exploit was 97 percent reliable in testing and earned a $92,337 payout through Google’s kernelCTF program. The flaw was fixed in April, but patch availability remains uneven, with Ubuntu still listing several LTS versions as vulnerable or in progress as of early July. The bug shipped by default in essentially every mainstream Linux distribution since 2011 and requires no special permissions or network access.
What’s reported
Nebula Security published exploit code for GhostLock (CVE-2026-43499), a use-after-free bug in the Linux kernel.
The bug sat undetected for 15 years and lets any logged-in user take root on an unpatched machine.
The flaw shipped by default in essentially every mainstream distribution since 2011.
The exploit requires no special permissions or network access and escapes containers.
Nebula found the bug using VEGA, its AI-driven bug-hunting tool.
The exploit was 97 percent reliable in testing and earned a $92,337 payout through Google’s kernelCTF program.
The flaw was fixed in April, but as of early July, Ubuntu still listed 24.04, 22.04, and 20.04 LTS as vulnerable or in progress.
Key figures
Nebula Security (security firm)
VEGA (AI-driven bug-hunting tool)
Sources: Wired
