A local Linux bug is now a host-compromise problem, not just a kernel patch item. GhostLock lets an unprivileged user take root on machines that still ship the vulnerable futex code, and Nebula has already shown it can also jump out of containers, so a low-privilege foothold can cross the boundary operators usually trust.
The flaw is a 15-year-old use-after-free in Linux futex cleanup code. Nebula says its exploit is 97% reliable, works without special permissions or network access, and has been published with working code; the bug has existed since 2011 and affects essentially every mainstream distribution that carried the code by default.
The practical risk is broader than one CVE on one host. Any shared Linux system, container platform, or Android-derived environment running the vulnerable kernel now has an isolation break at the kernel layer, and patching has to be treated as host containment, not just routine hardening.