Three high-profile Linux kernel studies published recently

Three high-profile Linux kernel studies published recently

Within a short period, three independent research projects were released as part of Google CTF's program, each focused on critical flaws in core Linux subsystems:

GhostLock (CVE-2026-43499) — a vulnerability in the futex priority inheritance (rt_mutex) mechanism. A logic flaw in the waiter cleanup routines leads to a stack use-after-free: the kernel continues to operate on an object that has already been freed from the stack. The researchers turned this primitive into a nearly reliable local privilege escalation (LPE) and container escape (≈97% success rate). The bug had existed for about 15 years and was discovered through Google kernelCTF.

Bad Epoll (CVE-2026-46242) — a synchronization bug in the epoll subsystem causes a heap use-after-free. Despite the race window being only a few instructions long, the researchers developed a nearly ≈99% reliable exploit for local privilege escalation on Linux and Android. This work was also conducted under Google kernelCTF.

Januscape (CVE-2026-53359) — a use-after-free vulnerability in KVM Shadow MMU. KVM continues to use a Shadow MMU object after it has been freed, allowing a guest VM to modify Shadow MMU data and execute code in the host kernel context. Unlike the previous two, this is a VM escape, rather than a classic LPE. The research was part of Google kvmCTF.

Article 1 (GhostLock): https://nebusec.ai/research/ionstack-part-2/

Article 2 (BadEpoll): https://github.com/J-jaeyoung/bad-epoll

Article 3 (Januscape): https://github.com/V4bel/Januscape