Linux Kernel rtmutex/futex-PI Stack Use-After-Free (GhostLock)

#!/usr/bin/env bash
# ghostlock_check.sh — Check for CVE-2026-43499 (GhostLock) vulnerability
# Run on target Linux host. No root required.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
echo "[*] Running kernel: $KERNEL"

# Check if FUTEX_PI is compiled in (required for vuln)
if [ -f /boot/config-"$KERNEL" ]; then
    if ! grep -q 'CONFIG_FUTEX=y' /boot/config-"$KERNEL" 2>/dev/null; then
        echo "[*] CONFIG_FUTEX not enabled in kernel config."
        echo "PATCHED"
        exit 0
    fi
fi

# Extract major.minor.patch from kernel version
# Handles formats like: 6.1.175-1-amd64, 5.15.0-187-generic, 7.0.4-200.fc40
VERSION=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')
if [ -z "$VERSION" ]; then
    echo "[!] Could not parse kernel version from: $KERNEL"
    echo "UNKNOWN"
    exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

echo "[*] Parsed version: $MAJOR.$MINOR.$PATCH"

# version_gte: returns 0 if $1.$2.$3 >= $4.$5.$6
version_gte() {
    local a1=$1 a2=$2 a3=$3 b1=$4 b2=$5 b3=$6
    if (( a1 > b1 )); then return 0; fi
    if (( a1 < b1 )); then return 1; fi
    if (( a2 > b2 )); then return 0; fi
    if (( a2 < b2 )); then return 1; fi
    if (( a3 >= b3 )); then return 0; fi
    return 1
}

# Fixed versions per stable branch:
#   7.1+           — fixed
#   7.0.4+         — fixed
#   6.18.27+       — fixed
#   6.12.86+       — fixed
#   6.6.140+       — fixed
#   6.1.175+       — fixed
#   < 2.6.39       — not affected (bug introduced in 2.6.39)

# Not affected: kernels before 2.6.39
if (( MAJOR < 2 )) || { (( MAJOR == 2 )) && (( MINOR < 6 )); } || \
   { (( MAJOR == 2 )) && (( MINOR == 6 )) && (( PATCH < 39 )); }; then
    echo "[+] Kernel predates the vulnerable code (introduced in 2.6.39)."
    echo "PATCHED"
    exit 0
fi

# 7.1+ is fixed
if version_gte "$MAJOR" "$MINOR" "$PATCH" 7 1 0; then
    echo "[+] Kernel $VERSION >= 7.1.0 — fixed upstream."
    echo "PATCHED"
    exit 0
fi

# 7.0.x branch
if (( MAJOR == 7 )) && (( MINOR == 0 )); then
    if version_gte "$MAJOR" "$MINOR" "$PATCH" 7 0 4; then
        echo "[+] Kernel $VERSION >= 7.0.4 — patched in stable."
        echo "PATCHED"
        exit 0
    else
        echo "[-] Kernel $VERSION < 7.0.4 — VULNERABLE."
        echo "VULNERABLE"
        exit 1
    fi
fi

# 6.18.x branch
if (( MAJOR == 6 )) && (( MINOR == 18 )); then
    if version_gte "$MAJOR" "$MINOR" "$PATCH" 6 18 27; then
        echo "[+] Kernel $VERSION >= 6.18.27 — patched in stable."
        echo "PATCHED"
        exit 0
    else
        echo "[-] Kernel $VERSION < 6.18.27 — VULNERABLE."
        echo "VULNERABLE"
        exit 1
    fi
fi

# 6.12.x branch
if (( MAJOR == 6 )) && (( MINOR == 12 )); then
    if version_gte "$MAJOR" "$MINOR" "$PATCH" 6 12 86; then
        echo "[+] Kernel $VERSION >= 6.12.86 — patched in stable."
        echo "PATCHED"
        exit 0
    else
        echo "[-] Kernel $VERSION < 6.12.86 — VULNERABLE."
        echo "VULNERABLE"
        exit 1
    fi
fi

# 6.6.x branch
if (( MAJOR == 6 )) && (( MINOR == 6 )); then
    if version_gte "$MAJOR" "$MINOR" "$PATCH" 6 6 140; then
        echo "[+] Kernel $VERSION >= 6.6.140 — patched in stable."
        echo "PATCHED"
        exit 0
    else
        echo "[-] Kernel $VERSION < 6.6.140 — VULNERABLE."
        echo "VULNERABLE"
        exit 1
    fi
fi

# 6.1.x branch
if (( MAJOR == 6 )) && (( MINOR == 1 )); then
    if version_gte "$MAJOR" "$MINOR" "$PATCH" 6 1 175; then
        echo "[+] Kernel $VERSION >= 6.1.175 — patched in stable."
        echo "PATCHED"
        exit 0
    else
        echo "[-] Kernel $VERSION < 6.1.175 — VULNERABLE."
        echo "VULNERABLE"
        exit 1
    fi
fi

# Any other 6.x or 5.x or 4.x or 3.x or 2.6.39+ kernel
# that is NOT on a patched stable branch is vulnerable
echo "[-] Kernel $VERSION is in the affected range (2.6.39–7.0.x) and not on a patched stable branch."
echo "    Check your distro's kernel package version for backported fixes."

# Attempt distro-specific package version check
if command -v dpkg &>/dev/null; then
    PKG=$(dpkg -l 'linux-image-*' 2>/dev/null | awk '/^ii.*linux-image-[0-9]/{print $2, $3}' | head -5)
    echo "[*] Installed kernel packages (dpkg):"
    echo "$PKG"
elif command -v rpm &>/dev/null; then
    PKG=$(rpm -qa 'kernel*' 2>/dev/null | head -5)
    echo "[*] Installed kernel packages (rpm):"
    echo "$PKG"
fi

echo "VULNERABLE"
exit 1