Artificial intelligence is starting to change vulnerability research in a very concrete way.
In July 2026, Nebula Security disclosed GhostLock (CVE-2026-43499), a Linux kernel vulnerability that had been present since 2011. The bug was found by VEGA, the company’s AI-based security research system.
Fifteen years inside the Linux kernel.
That alone is worth paying attention to.
What GhostLock actually does
GhostLock is a use-after-free vulnerability in the Linux kernel’s rtmutex and futex-PI code.
According to Nebula Security, an unprivileged local process can trigger the flaw using ordinary threading and futex system calls. No special capabilities, user namespaces or network access are required.
The researchers turned it into a privilege-escalation exploit capable of gaining root access and escaping containers, with a reported reliability of around 97 percent. The work received a $92,337 reward through Google’s kernelCTF program.
The vulnerability was introduced with Linux 2.6.39 in 2011. It was reported in April 2026, fixed shortly afterwards and publicly disclosed on July 7.
The interesting part is not only the bug
Linux has had serious vulnerabilities before. It will have more.
The interesting part here is how GhostLock was found.
VEGA is an AI-based vulnerability discovery system. Nebula Security says it has used the system to find hundreds of bugs across projects including the Linux kernel, Chrome, Firefox, nginx, curl, WordPress and CPython.
This does not mean AI independently does everything from discovery to exploitation and remediation.
In the case of GhostLock, the AI system found the vulnerability, while researchers analysed it, developed the exploitation chain, reported it and worked through the disclosure process.
But the balance is changing.
A human researcher has limited time. An AI-based system can examine enormous amounts of old code, revisit obscure paths and continue searching at a scale that would be difficult to reproduce manually.
And legacy code is exactly where this becomes interesting.
A bug can sit untouched for fifteen years not because nobody cares about security, but because modern software such as the Linux kernel is enormous, complex and constantly evolving.
AI gives researchers a new way to search that old code.
This is good news and bad news
For defenders, AI-assisted vulnerability discovery can expose bugs before attackers find them.
That is obviously valuable.
But the same capability does not belong exclusively to defenders.
If AI makes it cheaper and faster to search millions of lines of source code for exploitable mistakes, offensive security researchers and attackers can benefit from the same progress.
The result may be simple: more vulnerabilities found, faster.
And that puts even more pressure on patching, supported software versions and proper infrastructure maintenance.
What this means for Linux administrators
GhostLock is another reminder that a system being stable for years does not mean it is free of vulnerabilities.
The bug existed for approximately fifteen years. It affected major Linux distributions, and the researchers demonstrated both local privilege escalation and container escape.
For administrators, the lesson is not to panic every time a new CVE appears.
It is to keep systems maintained, understand what is actually exposed, follow security updates and avoid assuming that containers or long-running stable systems are automatically safe.
AI is not making Linux insecure.
It is making some of the bugs already hiding inside complex software easier to find.
And GhostLock is unlikely to be the last example.