Critical Linux Kernel SCTP Vulnerability Lets Attackers Gain Root

Key Takeaways

• A critical Linux kernel vulnerability, dubbed SCTPhantom (CVE-2026-64564), allows unprivileged local users to gain root privileges and escape containers.
• The flaw, a use-after-free bug in the Stream Control Transmission Protocol (SCTP), has existed in the kernel since December 2007, making it nearly 18 years old.
• Exploitation is highly reliable across various Linux distributions and kernel versions, with a CVSS v4.0 score of 8.5 (High severity).
• Patches are available and have been backported to stable kernel branches, including 6.6.148, 6.12.101, 6.18.42, and 7.1.6.

A severe vulnerability in the Linux kernel’s Stream Control Transmission Protocol (SCTP) has been uncovered, enabling local attackers to elevate privileges to root and even break out of containers. Identified as SCTPhantom and tracked as CVE-2026-64564, this flaw represents a significant security risk, particularly for systems utilizing SCTP or running containerized workloads.

Understanding the SCTPhantom Vulnerability

The core of the SCTPhantom vulnerability lies in a use-after-free bug within the kernel’s SCTP Dynamic Address Reconfiguration feature. Remarkably, this defect has been present in the Linux kernel since version 2.6.25, introduced in December 2007, meaning it remained undetected for almost 18 years.

Technical Details of the Flaw

The vulnerability specifically impacts how the kernel processes ASCONF (Add IP Address/Delete IP Address) chunks, a mechanism defined in RFC 5061 that facilitates dynamic modification of network paths within SCTP associations. The flaw arises from a logical inconsistency in address validation during a DEL-IP (delete IP address) operation.

When a DEL-IP request is processed, the kernel verifies the operation using the packet’s source address. However, a separate, cached pointer references the address parameter initially used to select the network path, or transport. An attacker can exploit this discrepancy by carefully orchestrating a sequence of ASCONF messages. This involves specifying an address, then deleting it, and subsequently sending a wildcard delete request. This sequence can trick the kernel into freeing a transport while a stale reference to it persists within the association’s active and primary path pointers. Later attempts to dereference this freed memory lead to the use-after-free condition.

Exploitation and Impact

Security researchers from the TencentOS Security Team, leveraging their autonomous vulnerability research system Corvus AI, successfully transformed this raw memory corruption bug into a full-fledged privilege escalation exploit chain. The exploit reclaims the freed transport memory using a packet socket ring buffer, which inadvertently leaks a kernel memory address.

Achieving Root and Container Escape

The leaked kernel address facilitates a repeatable four-byte kernel read, which the researchers utilized to bypass Kernel Address Space Layout Randomization (KASLR) by examining the interrupt descriptor table. Following this, a second use-after-free condition is triggered, this time involving attacker-controlled SCTP authentication key data. This allows the attacker to construct a fabricated kernel object graph, ultimately leading to a call to commit_creds, granting global root privileges without the need for traditional shellcode or a Return-Oriented Programming (ROP) chain.

The researchers went further, demonstrating that the same vulnerability permits a container-to-host escape. By employing per-socket SCTP options instead of system-wide sysctls, the exploit circumvented the need for elevated capabilities. This method successfully broke out of containers running default seccomp profiles in six out of eight attempts, ultimately executing a usermode-helper process within the host’s initial namespace.

The exploit chain’s effectiveness was validated across a broad spectrum of environments, including Ubuntu 24.04, Debian 13, Rocky Linux 9, and various kernel builds ranging from 5.14 to a 7.2 release candidate. In every tested scenario, the researchers achieved root access.

Under CVSS v4.0, CVE-2026-64564 has been assigned a base score of 8.5, indicating a High severity. This score reflects the vulnerability’s low attack complexity combined with its high impact on confidentiality, integrity, and availability.

Patch and Disclosure

The upstream patch, identified by commit 9b2854f86f0b, rectifies the vulnerability by disallowing any DEL-IP request that targets a transport still referenced by the current ASCONF chunk. This prevents the kernel from freeing memory that is still in use.

Fixes have been backported to several stable kernel branches, including 6.6.148, 6.12.101, 6.18.42, and 7.1.6. The Linux kernel CVE team officially announced CVE-2026-64564 on August 4, 2026, following a private disclosure process that commenced on July 12.

What You Should Do

• Immediately patch your Linux kernels to the fixed versions (6.6.148, 6.12.101, 6.18.42, 7.1.6, or newer) if you are running SCTP-enabled kernels.
• Prioritize patching in multi-tenant environments, cloud instances, and containerized deployments where the risk of container escape is critical.
• If immediate patching is not feasible, consider disabling SCTP if it is not a critical service, though this may not be a complete mitigation for all attack vectors.
• Regularly monitor security advisories from your Linux distribution vendor for specific patch availability and recommendations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.