--- title: GhostLock hits every Linux distro since 2011, Januscape... description: Two serious Linux kernel vulnerabilities dominated the week. GhostLock (CVE-2026-43499) is a stack use-after-free in rtmutex that has existed in every major... canonical: https://daily.dev/posts/ghostlock-hits-every-linux-distro-since-2011-januscape-earns-250k-bounty-libish6j8 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GhostLock hits every Linux distro since 2011, Januscape earns $250K bounty | daily.dev og:description: Two serious Linux kernel vulnerabilities dominated the week. GhostLock (CVE-2026-43499) is a stack use-after-free in rtmutex that has existed in every major... og:url: https://daily.dev/posts/ghostlock-hits-every-linux-distro-since-2011-januscape-earns-250k-bounty-libish6j8 og:image: https://api.daily.dev/og/posts/LIbISH6j8.png og:image:alt: GhostLock hits every Linux distro since 2011, Januscape earns $250K bounty og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GhostLock hits every Linux distro since 2011, Januscape earns $250K bounty **[Open Source Digest](https://daily.dev/sources/opensource_digest)** · 5 min read · 2 upvotes · 1 comments ## Summary Two serious Linux kernel vulnerabilities dominated the week. GhostLock (CVE-2026-43499) is a stack use-after-free in rtmutex that has existed in every major distro since 2011, with a 97% stable exploit that earned $92,337 in kernelCTF and full PoC code now public. Januscape (CVE-2026-53359), a KVM guest-to-host escape affecting both Intel and AMD, earned a $250K Google bug bounty and poses real risk to multi-tenant cloud environments. On the project side, Ollama raised $65M at nearly 9M monthly users, the Claude desktop app landed in Linux beta, and OpenMandriva dealt with an internal sabotage attempt that deleted years of repository history. ## Content **TLDR:** Two serious Linux kernel vulnerabilities dominated the week. GhostLock (CVE-2026-43499) is a stack use-after-free in rtmutex that has existed in every major distro since 2011, with a 97% stable exploit that earned $92,337 in kernelCTF and full PoC code now public. Januscape (CVE-2026-53359), a KVM guest-to-host escape affecting both Intel and AMD, earned a $250K Google bug bounty and poses real risk to multi-tenant cloud environments. On the project side, Ollama raised $65M at nearly 9M monthly users, the Claude desktop app landed in Linux beta, and OpenMandriva dealt with an internal sabotage attempt that deleted years of repository history. --- ## GhostLock (CVE-2026-43499): 15-year-old kernel stack UAF with public exploit A stack use-after-free in rtmutex's remove_waiter() function has been present in every major Linux distribution since kernel 2.6.39 in 2011, through 7.1. The bug incorrectly clears pi_blocked_on on the wrong task during a FUTEX_CMP_REQUEUE_PI deadlock rollback, leaving a dangling pointer into freed kernel stack memory. No special privileges are required beyond CONFIG_FUTEX_PI=y, which is on by default. The full exploit chain — KASLR leak via prefetch timing, stack frame reclaim via PR_SET_MM_MAP, control flow hijack via a loopback IPv6 UDP packet, and a ROP chain using DirtyMode — achieves 97% stability and earned $92,337 in Google's kernelCTF. Full PoC code is now open-sourced. [Read more](https://daily.dev/feed-by-ids?id=6DXp2gJyT&id=wZNoxDUhk) ## Januscape (CVE-2026-53359): KVM guest-to-host escape earns $250K bounty A 16-year-old use-after-free in KVM's shadow MMU emulation allows a guest VM to escape and gain root on the host, affecting both Intel and AMD x86_64. It's the first known KVM exploit working across both CPU vendors, which makes it a genuine threat to multi-tenant cloud environments where tenants share physical hardware. Researcher Hyunwoo Kim earned a $250K Google bug bounty; a PoC that crashes the host from inside a guest is public, though the full escape exploit is being withheld. A patch landed in June 2026. On distros where /dev/kvm is world-writable, unprivileged users can also reach it. The recommended mitigation is disabling nested virtualization by unloading kvm_amd and kvm_intel modules. [Read more](https://daily.dev/feed-by-ids?id=e9GiIYtfE&id=dP9GDnMga&id=pgTeQQQ1I&id=sZ8YgAzlD) ## Ollama raises $65M Series B, reaches nearly 9M monthly users Ollama, the tool that lets developers run open-weight AI models locally, closed a $65M Series B led by Theory Venture, bringing total funding to $88M. The company now serves nearly 9 million monthly active developers and claims presence in 85% of Fortune 500 companies — all with 14 employees. Founded by the Docker Desktop team, Ollama also offers a cloud tier for models too large to run locally. Some community members have raised concerns about the commercialization trajectory, which is a familiar tension for tools that built their audience on being free and local-first. [Read more](https://daily.dev/feed-by-ids?id=6qwGfOByx&id=6Dp0BqV9j) ## OpenMandriva sabotage: former contributor deletes repos and pushes malicious package A former OpenMandriva contributor, Davide Beatrici, abused administrative access to delete years of GitHub repository history and push an empty package that obsoleted all GNOME and Cosmic desktop packages in the Cooker development branch — potentially damaging user systems. He had gained admin privileges after helping migrate repositories to his private OneDev instance. Beatrici disputes the sabotage framing, claiming it was a response to internal disputes and unauthorized file deletions by other members. OpenMandriva is restoring deleted content and conducting a full audit but has decided not to pursue legal action despite stating the actions constitute a criminal offense. [Read more](https://daily.dev/feed-by-ids?id=IRuS7Xtk8&id=dnNXl1Q2F&id=mchmN7Ilx&id=eVSBeeB4i) --- ## Also notable - **Claude desktop app for Linux enters beta via official apt repo:** Anthropic released a Linux beta of the Claude desktop app, installable via an official apt repository for Ubuntu 22.04+ and Debian 12+, offering chat, Cowork, and Claude Code features including parallel sessions and visual diff review — Computer Use and voice dictation are not yet available on Linux. [Read more](https://daily.dev/posts/3ljrmnxhO) - **U-Boot FIT signature verification has 6 CVEs, some allowing pre-OS code execution:** Binarly disclosed six vulnerabilities (BRLY-2026-037 through BRLY-2026-042) in U-Boot's FIT signature verification code, present since version 2013.07 and potentially affecting 50+ stable releases; two flaws allow arbitrary code execution before the OS loads, enabling persistent firmware malware on embedded Linux devices, BMCs, and IoT systems. [Read more](https://daily.dev/posts/306QQF8Os) - **Linux Mint 23 graduates Wayland to fully supported, X11 stays:** Linux Mint has officially declared Wayland stable in Cinnamon, with both X11 and Wayland fully supported in the next release due around Christmas 2026 — key improvements include full HiDPI support, GBM over EGL for Nvidia GPUs, and a redesigned screensaver that runs natively on both display servers. [Read more](https://daily.dev/feed-by-ids?id=8oz5mviZf&id=7WMQ8Fk2x&id=Z9pjuPcH4&id=2FasC1lNk) - **Realtek RTL8723BS WiFi driver hardened against malicious access points:** Security patches for the RTL8723BS staging driver fix multiple out-of-bounds memory access vulnerabilities present since the driver entered Linux staging in 2017, triggered by malicious WiFi access points sending crafted over-the-air frames — fixes are being merged ahead of Linux 7.2-rc3 and will be backported to stable kernels. [Read more](https://daily.dev/posts/bWsdsZwUX) - **Canonical commits €40,000/year to fund ntpd-rs, targeting Ubuntu 27.04 default:** Canonical became a Gold Sponsor of the Trifecta Tech Foundation at €40,000 per year, with the current focus on ntpd-rs — a Rust rewrite of NTP already in production at Let's Encrypt since June 2024 — targeting inclusion in Ubuntu 26.10 for testing and default status in Ubuntu 27.04. [Read more](https://daily.dev/posts/m17mH0KxF) ## Community discussion Top comments from developers on daily.dev. **@bits\_and\_bytes** · 0 upvotes > Januscape is the more concerning one for me. A KVM guest-to-host escape that works on both Intel and AMD means any cloud provider still running unpatched hosts has a real tenant isolation problem, not a theoretical one. ## Similar posts on daily.dev - [Google pays $250K for Linux vulnerability allowing guest VM escapes](https://daily.dev/posts/google-pays-250k-for-linux-vulnerability-allowing-guest-vm-escapes-dp9gdnmga) · Ars Technica · 2 upvotes · 0 comments - [New Linux kernel flaw allows VM escape on Intel, AMD devices](https://daily.dev/posts/new-linux-kernel-flaw-allows-vm-escape-on-intel-amd-devices-pgteqqq1i) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/ghostlock-hits-every-linux-distro-since-2011-januscape-earns-250k-bounty-libish6j8) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/ghostlock-hits-every-linux-distro-since-2011-januscape-earns-250k-bounty-libish6j8","headline":"GhostLock hits every Linux distro since 2011, Januscape earns $250K bounty","text":"Two serious Linux kernel vulnerabilities dominated the week. GhostLock (CVE-2026-43499) is a stack use-after-free in rtmutex that has existed in every major distro since 2011, with a 97% stable exploit that earned $92,337 in kernelCTF and full PoC code now public. Januscape (CVE-2026-53359), a KVM guest-to-host escape affecting both Intel and AMD, earned a $250K Google bug bounty and poses real risk to multi-tenant cloud environments. On the project side, Ollama raised $65M at nearly 9M monthly users, the Claude desktop app landed in Linux beta, and OpenMandriva dealt with an internal sabotage attempt that deleted years of repository history.","url":"https://daily.dev/posts/ghostlock-hits-every-linux-distro-since-2011-januscape-earns-250k-bounty-libish6j8","datePublished":"2026-07-13T04:21:11.263Z","dateModified":"2026-07-13T04:21:27.855Z","author":{"@type":"Organization","name":"Open Source Digest","logo":"https://media.daily.dev/image/upload/s--9lMKiPTq--/f_auto,q_auto/v1773839407/logos/opensource_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/opensource_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"comment":[{"@type":"Comment","text":"Januscape is the more concerning one for me. A KVM guest-to-host escape that works on both Intel and AMD means any cloud provider still running unpatched hosts has a real tenant isolation problem, not a theoretical one.","datePublished":"2026-07-14T03:28:14.595Z","url":"https://daily.dev/posts/LIbISH6j8#c-irfoGXuW6","author":{"@type":"Person","name":"bits_007","url":"https://daily.dev/bits_and_bytes","image":"https://avatars.githubusercontent.com/u/182549945?v=4"}}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/opensource_digest","name":"Open Source Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Open Source Digest","item":"https://daily.dev/sources/opensource_digest"},{"@type":"ListItem","position":3,"name":"GhostLock hits every Linux distro since 2011, Januscape earns $250K bounty"}]} ```