A newly disclosed Linux kernel vulnerability, CVE-2026-64564, dubbed SCTPhantom, has revealed how an 18-year-old bug in the Linux SCTP networking stack can be exploited to gain root privileges and potentially escape containers.
Security researchers at Tencent Zhuque Lab demonstrated that the flaw can be leveraged to compromise the host operating system from within a container under specific conditions, making it a serious concern for Linux administrators and cloud environments.
What Is SCTPhantom (CVE-2026-64564)?
SCTPhantom is a use-after-free (UAF) vulnerability affecting Linux’s implementation of the Stream Control Transmission Protocol (SCTP). According to researchers, the bug has existed since Linux kernel 2.6.25, released in 2008, meaning it has silently affected Linux systems for nearly two decades.
The vulnerability stems from improper memory handling during SCTP address deletion operations, allowing attackers to manipulate freed memory and potentially execute arbitrary code with kernel privileges.
How the Vulnerability Works
SCTP supports multi-homing, allowing a single connection to use multiple network paths simultaneously. It also includes Dynamic Address Reconfiguration (Add-IP), enabling peers to add or remove IP addresses during an active session.
The flaw occurs because the Linux kernel validates an address deletion request against one network address while performing the deletion on another address referenced inside the same SCTP message.
A specially crafted sequence can:
- Add an address.
- Delete that same address.
- Trigger a wildcard delete.
This sequence frees an internal transport object while leaving the kernel with a dangling pointer that is later reused, resulting in a classic use-after-free condition.
The official patch prevents deletion of the transport currently being processed, eliminating the vulnerable code path.
Container Escape Demonstrated
Tencent Zhuque Lab claims it successfully exploited SCTPhantom to escape a Linux container and gain root access on the underlying host.
During testing, researchers reported successful privilege escalation on multiple Linux distributions, including:
- Debian 13
- Ubuntu 24.04
- Rocky Linux 9
- Red Hat Enterprise Linux (RHEL) 9
- OpenCloudOS
Initially, researchers believed exploitation required enabling the following SCTP-related sysctls:
net.sctp.addip_enablenet.sctp.addip_noauth_enable
However, they later discovered an alternative technique that enables the required functionality on a per-socket basis, removing the need to modify these kernel parameters.
According to the research, the exploit:
- Required neither CAP_NET_ADMIN nor CAP_SYS_ADMIN capabilities.
- Worked with the default seccomp profile.
- Successfully achieved host root access in 6 out of 8 test attempts.
It is worth noting that these results have not yet been independently verified, and the researchers did not disclose which container runtime was used during testing.
Is the Vulnerability Being Exploited?
At the time of publication:
- No public proof-of-concept (PoC) exploit had been released.
- The vulnerability does not appear in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
- No confirmed reports of active exploitation have been published.
The vulnerability was publicly disclosed on August 6, 2026, two days after receiving its CVE assignment.
Who Is Affected?
The flaw affects Linux kernels dating back to 2008.
It has been fixed in the following stable kernel releases:
- Linux 6.6.148
- Linux 6.12.101
- Linux 6.18.42
- Linux 7.1.6
Systems running older kernels with SCTP enabled and reachable should be updated immediately.
Administrators should also remember that many Linux distributions backport security fixes without changing the upstream kernel version. Therefore, checking the kernel version alone may not confirm whether a system is protected. Always verify your distribution’s security advisories.
Severity and Risk
The vulnerability is considered local rather than remotely exploitable, meaning an attacker must already have local access and SCTP must be available on the target system.
Tencent assigned the flaw a CVSS v4.0 score of 8.5, indicating high severity. At the time of disclosure, the U.S. National Vulnerability Database (NVD) had not yet assigned an official CVSS score or CWE classification.
Exposure also depends on factors such as:
- SCTP availability
- Container runtime configuration
- Seccomp policies
- User namespace restrictions
- Socket permissions
Some vendors have assessed the impact more conservatively. For example, the openKylin security advisory primarily highlights the possibility of kernel crashes and denial-of-service (DoS).
Additional SCTP Issue Also Fixed
Administrators should be aware that another use-after-free vulnerability affecting SCTP transport handling was patched on August 6, after the August 3 stable kernel releases were published.
As a result, systems updated only to the August 3 kernel versions may still require additional security updates.
Mitigation Recommendations
To reduce the risk posed by SCTPhantom:
- Update to the latest security-patched Linux kernel provided by your distribution.
- Review your distribution’s security advisories instead of relying solely on kernel version numbers.
- Disable or blacklist the SCTP kernel module if your environment does not require SCTP.
- Review container security policies, socket permissions, and namespace configurations.
AI-Assisted Vulnerability Discovery
Tencent credits the discovery of SCTPhantom to Corvus AI, its multi-agent AI research framework designed for Linux kernel security analysis.
The finding continues a growing trend of AI-assisted vulnerability research, following other recently disclosed Linux kernel flaws uncovered with machine-assisted analysis.
Final Thoughts
Although SCTPhantom requires local access and specific SCTP conditions, its potential impact is significant. The ability to obtain kernel-level privileges—and, according to Tencent’s testing, escape containers—makes it a vulnerability that Linux administrators should address promptly.
Organizations running Linux servers, Kubernetes clusters, or containerized workloads should ensure their systems receive the latest kernel security updates and disable SCTP where it is not required.
