Detecting GhostLock (CVE-2026-43499): Linux Kernel LPE with Sigma and KQL

CVE-2026-43499, named GhostLock by Nebula Security researchers who found it using their VEGA AI analysis tool, is a use-after-free in the Linux kernel’s futex priority inheritance code that has been present since 2011. Nebula’s working exploit takes around five seconds, achieves root from any logged-in user with no special permissions, escapes containers, and earns a documented 97% success rate. The exploit code is public.

Detection is complicated by several factors. The exploit abuses normal threading primitives — futex operations that any legitimate multithreaded application also performs — and the privilege escalation itself happens inside the kernel rather than through observable process calls. What’s detectable is the before (the futex abuse pattern), the moment (uid/gid change without a legitimate auth event), and the after (root-level activity from a process lineage that started unprivileged).

This guide covers all three phases: what to configure, what to detect, and how to write it as Sigma and KQL.

Prerequisites: Auditd and Enhanced Linux Logging

Most of the signals here require Linux Audit daemon (auditd) with appropriate rules. Confirm it’s running and capturing the right syscalls:

# Verify auditd is running
systemctl status auditd

# Check current rules include syscall capture for target syscalls
auditctl -l | grep -E "futex|setuid|clone|unshare"

# Add rules for GhostLock-relevant syscalls if missing
auditctl -a always,exit -F arch=b64 -S futex -k futex_monitor
auditctl -a always,exit -F arch=b64 -S setuid -S setgid -S setresuid -S setresgid -k setuid_monitor
auditctl -a always,exit -F arch=b64 -S unshare -k namespace_monitor

Persistent rules go in /etc/audit/rules.d/ghostlock.rules:

# GhostLock/CVE-2026-43499 detection rules
-a always,exit -F arch=b64 -S futex -k futex_monitor
-a always,exit -F arch=b64 -S setuid -S setgid -S setresuid -S setresgid -k privilege_escalation
-a always,exit -F arch=b64 -S clone -F a0&0x10000000 -k thread_manipulation
-a always,exit -F arch=b64 -S unshare -k namespace_change
-w /etc/passwd -p wa -k passwd_modification
-w /etc/shadow -p wa -k shadow_modification
-w /etc/sudoers -p wa -k sudoers_modification

For environments forwarding to Defender for Endpoint or Sentinel via the MMA/AMA agent, ensure Linux audit log collection is configured in the Data Collection Rule.

Phase 1: Detecting the Futex Abuse Pattern

GhostLock exploits the futex FUTEX_LOCK_PI operation’s error-path cleanup. The exploit drives a specific sequence: a thread acquires a priority-inheritance futex, a second thread attempts the same lock under contention, then a deliberately engineered exit condition triggers the use-after-free.

The raw syscall sequence is not unique to the exploit — legitimate threaded applications use futex PI heavily. The signal is the combination: high-frequency futex PI operations from a short-lived, non-daemon process, followed within seconds by a setuid or setresuid call from the same process tree.

Sigma Rule — Futex PI Spike Followed by Privilege Escalation:

title: Potential GhostLock Exploitation - Futex PI Abuse with Privilege Escalation
id: a7f3e912-8c21-4b5d-9e33-1f2a4c6d8e0f
status: experimental
description: Detects high-frequency futex LOCK_PI syscalls from a non-daemon process followed by setuid/setresuid in the same process tree — a pattern consistent with CVE-2026-43499 GhostLock exploitation.
references:
  - https://thehackernews.com/2026/07/15-year-old-ghostlock-flaw-enables-root.html
  - https://nvd.nist.gov/vuln/detail/CVE-2026-43499
author: SOC Analyst Hub
date: 2026/07/14
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026-43499
logsource:
  product: linux
  service: auditd
detection:
  syscall_futex:
    type: SYSCALL
    syscall: futex
    a1|contains: "80"  # FUTEX_LOCK_PI = 0x0D with FUTEX_PRIVATE_FLAG 0x80
  followed_by_priv_esc:
    type: SYSCALL
    syscall|in:
      - setuid
      - setresuid
      - setresgid
    a0: "0"  # setuid(0) = root
  condition: syscall_futex and followed_by_priv_esc
timeframe: 10s
falsepositives:
  - Applications that legitimately elevate privileges (sudo, su, polkit)
  - Container orchestration runtimes with privilege management
level: high

Phase 2: Detecting the Root Acquisition

The clearest observable signal is a process executing as UID 0 (root) whose parent process chain began as an unprivileged user without going through a legitimate authentication or privilege transition (sudo, su, polkit, PAM).

Sigma Rule — Unexpected Root Execution from Unprivileged Lineage:

title: Unexpected Root Execution Without Authentication Event
id: b8e4f023-9d32-5c6e-af44-2g3b5d7e9f1g
status: experimental
description: Detects a process running as UID 0 where the parent process was running as an unprivileged UID and no corresponding sudo/su/polkit authentication event was logged. Indicative of kernel privilege escalation.
author: SOC Analyst Hub
date: 2026/07/14
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  root_exec:
    type: SYSCALL
    uid: "!0"           # Parent was not root
    euid: "0"           # Effective UID is now root
  not_legitimate:
    type: EXECVE
    a0|in:
      - sudo
      - su
      - pkexec
      - newgrp
  condition: root_exec and not not_legitimate
falsepositives:
  - SUID binaries invoked legitimately
  - Container runtimes (runc, containerd) operating with expected privilege grants
level: high

Phase 3: Container Escape Detection

GhostLock’s exploit escapes container namespaces. A container escape surfaces as a process that was previously bound to a container’s mount/network/PID namespace suddenly executing in the host namespace. The unshare syscall and changes to /proc/<pid>/ns/ entries are key signals.

Sigma Rule — Container Namespace Escape Indicator:

title: Process Namespace Escape - Potential Container Breakout
id: c9f5g134-ae43-6d7f-b055-3h4c6e8f0g2h
status: experimental
description: Detects a process using unshare(2) to leave its current PID, mount, or network namespace — a known technique in container escape chains including those leveraging kernel LPE.
author: SOC Analyst Hub
date: 2026/07/14
tags:
  - attack.privilege_escalation
  - attack.t1611
  - attack.t1068
logsource:
  product: linux
  service: auditd
detection:
  namespace_escape:
    type: SYSCALL
    syscall: unshare
    # CLONE_NEWNS=0x20000 | CLONE_NEWPID=0x20000000 | CLONE_NEWNET=0x40000000
    a0|contains:
      - "20000"
      - "40000000"
  from_container:
    type: PROCTITLE
    proctitle|contains:
      - "containerd"
      - "runc"
      - "docker"
  condition: namespace_escape
falsepositives:
  - Container runtimes performing legitimate namespace operations
  - systemd-nspawn containers
level: medium

KQL for Microsoft Defender for Endpoint / Sentinel

Defender for Endpoint’s Linux agent surfaces process events through DeviceProcessEvents. The Linux MDE agent captures uid/euid transitions via process event enrichment.

KQL — Root Process with Unprivileged Parent:

DeviceProcessEvents
| where DeviceName has_any ("linux") or OSPlatform == "Linux"
| where AccountName == "root" or ProcessTokenElevationType == "Full"
| join kind=leftouter (
    DeviceProcessEvents
    | where AccountName != "root"
    | project ParentProcessId = ProcessId, ParentAccountName = AccountName, DeviceId
) on DeviceId, $left.InitiatingProcessId == $right.ParentProcessId
| where isnotempty(ParentAccountName) and ParentAccountName != "root"
| where InitiatingProcessFileName !in~ ("sudo", "su", "pkexec", "newgrp", "runuser")
| project Timestamp, DeviceName, AccountName, ParentAccountName,
          FileName, ProcessCommandLine, InitiatingProcessFileName,
          InitiatingProcessCommandLine, FolderPath
| order by Timestamp desc

KQL — High-Frequency Futex Followed by Setuid (via DeviceEvents):

let futex_events = DeviceEvents
| where ActionType == "SyscallAuditEvent"
| where AdditionalFields has "futex"
| where AdditionalFields has "LOCK_PI"
| project FutexTime = Timestamp, DeviceId, ProcessId;
let setuid_events = DeviceEvents
| where ActionType == "SyscallAuditEvent"
| where AdditionalFields has_any ("setuid", "setresuid")
| where AdditionalFields has "a0=0"
| project SetuidTime = Timestamp, DeviceId, ProcessId;
futex_events
| join kind=inner setuid_events on DeviceId, ProcessId
| where SetuidTime > FutexTime and SetuidTime < FutexTime + 10s
| project FutexTime, SetuidTime, DeviceId, ProcessId
| order by FutexTime desc

Post-Exploitation Hunting Queries

After gaining root, GhostLock-assisted attackers will typically: read /etc/shadow, modify /etc/passwd or /etc/sudoers, drop SSH keys, disable audit logging, or prepare for lateral movement. These queries hunt the post-exploitation phase.

KQL — Sensitive File Modification by Unusual Process:

DeviceFileEvents
| where FolderPath in~ ("/etc/shadow", "/etc/passwd", "/etc/sudoers", "/root/.ssh/authorized_keys")
| where InitiatingProcessFileName !in~ ("passwd", "useradd", "usermod", "sshd", "sudo", "ansible-playbook")
| project Timestamp, DeviceName, FolderPath, FileName, ActionType,
          InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by Timestamp desc

Sigma — Auditd Disabled After Privilege Escalation:

title: Audit Daemon Disabled or Rules Cleared After Privilege Escalation
id: d0g6h245-bf54-7e8g-c166-4i5d7f9g1h3i
status: experimental
description: Detects auditd being stopped, disabled, or its rules flushed — a common post-exploitation step after kernel LPE to inhibit forensic logging.
author: SOC Analyst Hub
date: 2026/07/14
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  product: linux
  service: auditd
detection:
  auditd_tamper:
    type: SYSCALL
    exe|in:
      - /sbin/auditctl
      - /usr/sbin/auditctl
    a0|in:
      - "-D"      # flush all rules
      - "-e 0"    # disable audit
  stop_service:
    type: EXECVE
    a0: systemctl
    a1|in:
      - stop
      - disable
    a2: auditd
  condition: auditd_tamper or stop_service
level: critical

Immediate Response Actions

If detection fires in a production environment:

1. Isolate the host from the network before forensic collection — the exploit gives root in seconds and attackers move fast.
2. Snapshot memory where possible (VM snapshots capture kernel state for forensic analysis of the UAF chain).
3. Collect /var/log/audit/audit.log and /proc/<suspicious_pid>/maps before the process terminates.
4. Check for persistence: crontab -l -u root, /etc/cron.d/, /etc/rc.local, new SSH keys in /root/.ssh/.
5. Patch: Install the current kernel from your distribution. Verify the exact package version — Ubuntu LTS variants had uneven coverage as of early July.

Note that RANDOMIZE_KSTACK_OFFSET and STATIC_USERMODE_HELPER build options make the exploit significantly harder but are not fixes. Treat them as temporary mitigations only.