modules: add ghostlock (CVE-2026-43499, "GhostLock" rtmutex/futex requeue-PI stack UAF)

Adds the ghostlock module for CVE-2026-43499 ("GhostLock", VEGA / Nebula
Security's "IonStack part II") — a ~15-year race UAF on kernel STACK memory in
the rtmutex/futex requeue-PI path (kernel/locking/rtmutex.c). On the -EDEADLK
deadlock-rollback, remove_waiter() runs against `current` instead of the waiter
task, so a concurrent sched_setattr()-driven PI-chain priority walk on another
CPU clears pi_blocked_on on the wrong task and leaves an on-stack rt_mutex_waiter
dangling. Reachable by any unprivileged user (CVSS 7.8, PR:L) — plain
futex(2) + sched_setattr(2), no userns/CONFIG beyond CONFIG_FUTEX_PI. The
corpus's first rtmutex/futex-PI module and first kernel-stack UAF (all others
are heap/slab).

Introduced 2.6.39; fixed 3bfdc63936dd (7.1-rc1), stable backports
7.0.4 / 6.18.27 / 6.12.86 / 6.6.140 / 6.1.175; 5.15/5.10/5.4/4.19 affected with
no upstream fix. CWE-416; not in KEV.

detect() is a pure version gate over the five-branch backport table. exploit()
forks an isolated child that (A) deterministically confirms the -EDEADLK
remove_waiter() rollback path is reachable (safe — no concurrent walk means no
dangling pointer; validated on real hardware) then (B) exercises the actual race
a hard-bounded 24 iters / 2s with a sibling-CPU sched_setattr(SCHED_BATCH) storm,
and stops. Deliberately under-driven: no copy_from_user widening, no stack-frame
spray/reoccupation, and the KernelSnitch leak -> forged-waiter ->
fops/ashmem/pipe R/W -> cred-patch chain (Android/Pixel-specific, per-build
offsets) is NOT bundled. Returns EXPLOIT_FAIL. Lowest --auto safety rank (11) —
a won race corrupts the kernel stack. Unlike most races it ships a real
detection signature (futex requeue-PI returning EDEADLK + sibling sched_setattr);
auditd/sigma anchor on sched_setattr, falco/eBPF on the EDEADLK tell; no yara.

Wired: registry, Makefile, safety rank 11, version 0.9.13, 9 detect() test rows
(incl. 6.13.0 -> VULNERABLE, the multi-branch "newer than all" case), CVE
metadata (CWE-416 / T1068 / not-KEV; cve_metadata.c + KEV_CROSSREF.md regenerated
-> 13 of 40), README + CVES.md + website counts (45 modules / 40 CVEs),
RELEASE_NOTES v0.9.13, verify-vm target. Also corrects pre-existing
docs/index.html drift left by v0.9.12 (body counts stuck at 43/38 and a missing
bad_epoll corpus pill). Tests: 33 kernel_range + 101 detect, all pass.

Credit: VEGA / Nebula Security (nebusec.ai, NebuSec/CyberMeowfia, Apache-2.0);
upstream fix 3bfdc63936dd (Keenan Dong / Thomas Gleixner).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KUq4DGXSPBmPkAyJ9WnM9n

docs/RELEASE_NOTES.md

@@ -1,3 +1,57 @@
+## SKELETONKEY v0.9.13 — new LPE module: ghostlock (CVE-2026-43499)
+
+Adds **`ghostlock` — CVE-2026-43499 "GhostLock"** (VEGA / Nebula Security,
+"IonStack part II"), taking the corpus to **45 modules / 40 CVEs** and opening a
+brand-new subsystem: **rtmutex / futex requeue-PI** (`kernel/locking/rtmutex.c`).
+It is also the corpus's first kernel-**stack** use-after-free — every other UAF
+in the set is heap/slab. On the `-EDEADLK` deadlock-rollback path,
+`remove_waiter()` operates on `current` instead of the actual waiter task while
+unwinding a proxy lock in `rt_mutex_start_proxy_lock()` (reached from
+`futex_requeue()`); if a concurrent PI-chain priority walk — driven from another
+CPU via `sched_setattr()` — runs at that instant, `pi_blocked_on` is cleared on
+the wrong task and an on-stack `rt_mutex_waiter` is left dangling, becoming a
+controlled kernel write when the rbtree is later rotated over the reused frame.
+Reachable by **any unprivileged user** (CVSS 7.8, PR:L) — plain `futex(2)` +
+`sched_setattr(2)`, no user namespace, no capability, only `CONFIG_FUTEX_PI`
+(universal). It has existed since PI-futex requeue landed in **2.6.39** — ~15
+years across every distribution. The public exploit weaponises it (Android/Pixel)
+via a "KernelSnitch" futex-bucket page leak → forged waiter → `struct file`
+`f_op` → configfs/ashmem R/W → pipe physical R/W → cred patch; ~97% stable on
+kernelCTF, $92,337. Introduced 2.6.39; fixed `3bfdc63936dd` (merged 7.1-rc1),
+stable backports 7.0.4 / 6.18.27 / 6.12.86 / 6.6.140 / 6.1.175 — the
+5.15/5.10/5.4/4.19 LTS branches are affected with no upstream fix. CWE-416 (race
+root cause CWE-362); not in CISA KEV.
+
+🟡 **Trigger (reconstructed) — reachability-only, deliberately under-driven, not
+VM-verified.** `detect()` is a pure kernel-version gate over a five-branch
+backport table (7.0.4 / 6.18.27 / 6.12.86 / 6.6.140 / 6.1.175, 7.1+ inherits
+mainline; 5.15/5.10/5.4/4.19 affected with no fix; < 2.6.39 not affected) — no
+userns/CONFIG probe (`CONFIG_FUTEX_PI` assumed). `exploit()` forks an isolated
+child that **(A)** deterministically confirms the `-EDEADLK` `remove_waiter()`
+rollback path is reachable — a **safe** witness, since without a concurrent
+priority walk the unwind creates no dangling pointer (validated on real hardware:
+the requeue-PI cycle returns `-EDEADLK` reliably) — then **(B)** exercises the
+actual race a hard-bounded 24 iterations / 2 s with a sibling-CPU
+`sched_setattr(SCHED_BATCH)` storm, and stops. It does **not** widen the
+`copy_from_user` window (no memfd/`PUNCH_HOLE`), does **not** spray or reoccupy
+the freed stack frame, and does **not** bundle the KernelSnitch leak →
+forged-waiter → fops/configfs/ashmem/pipe R/W → cred-patch chain (Android/Pixel-
+specific, per-build offsets). Returns `EXPLOIT_FAIL`. It carries the corpus's
+**lowest `--auto` safety rank (11)** — a won race corrupts the kernel stack and
+drives a near-arbitrary pointer write (near-certain panic), so `--auto` only
+reaches for it after every safer vulnerable module. Unlike most kernel races
+GhostLock has a **real detection signature**: a futex requeue-PI op returning
+`-EDEADLK` (glibc never provokes this) plus tight-loop
+`sched_setattr(SCHED_BATCH)` on a sibling thread — the shipped auditd/sigma rules
+anchor on `sched_setattr` + the post-exploitation euid-0 transition, the
+falco/eBPF rule on the requeue-PI-EDEADLK tell; no yara. Wired: registry,
+Makefile, safety rank (11), 9 `detect()` test rows (incl. the multi-branch
+"newer than all" case 6.13.0 → VULNERABLE), CVE metadata (CWE-416 / T1068 /
+not-KEV), README + CVES.md + website counts (45/40), RELEASE_NOTES v0.9.13, and a
+verify-vm target (sweep pending). Also corrects pre-existing website drift left
+by v0.9.12 (index.html body counts + the missing `bad_epoll` corpus pill).
+Credits VEGA / Nebula Security + the upstream fix `3bfdc63936dd`.
+
 ## SKELETONKEY v0.9.12 — new LPE module: bad_epoll (CVE-2026-46242)
 
 Adds **`bad_epoll` — CVE-2026-46242 "Bad Epoll"** (Jaeyoung Chung /