A newly disclosed Linux kernel vulnerability, dubbed SCTPhantom and tracked as CVE-2026-64564, allows attackers to escalate from unprivileged local access to full root and even escape containers to compromise the underlying host.
The flaw is a use-after-free bug in the kernel’s SCTP Dynamic Address Reconfiguration feature, and remarkably, its root cause traces back to code introduced in Linux 2.6.25 in December 2007, making it nearly 18 years old before discovery.
The vulnerability lives in how the kernel handles ASCONF chunks, a mechanism defined in RFC 5061 that lets SCTP associations add, remove, or reconfigure network paths on the fly.
The bug stems from an identity mismatch: the kernel validates a DEL-IP delete operation using the packet’s source address, while a separate cached pointer relies on the address parameter used to select the actual network path, or transport.
By crafting an ordered ASCONF sequence, such as specifying an address, deleting that same address, and then sending a wildcard delete, an attacker can trick the kernel into removing a transport while a stale reference to it lingers in the association’s active and primary path pointers. A later socket operation then dereferences this freed memory, creating the use-after-free condition.
Security researchers at TencentOS Security Team, using an autonomous vulnerability-research system called Corvus AI, turned this raw memory bug into a complete privilege-escalation chain. The exploit reclaims the freed transport using a packet socket ring buffer, leaking a kernel memory address in the process.
That leak enables a repeatable four-byte kernel read, which researchers used to defeat KASLR by inspecting the interrupt descriptor table. From there, a second use-after-free is exploited with attacker-controlled SCTP authentication key data, allowing the attacker to build a fake kernel object graph that ultimately triggers commit_creds and hands over global root privileges, all without shellcode or a traditional ROP chain.
The researchers went further, demonstrating that the same flaw allows container-to-host escape. By using per-socket SCTP options instead of system-wide sysctls, the exploit avoided needing elevated capabilities, successfully breaking out of containers running default seccomp profiles in six of eight attempts, ultimately triggering a usermode-helper process running in the host’s initial namespace.
The exploit chain was validated across a wide range of environments, including Ubuntu 24.04, Debian 13, Rocky Linux 9, and multiple kernel builds ranging from 5.14 to a 7.2 release candidate, achieving root in every tested case.
Under CVSS v4.0, the flaw carries a base score of 8.5, rated High severity, reflecting its combination of low attack complexity and high impact on confidentiality, integrity, and availability.
The upstream patch, merged as commit 9b2854f86f0b, closes the gap by rejecting any DEL-IP request targeting the transport still referenced by the current ASCONF chunk.
Fixes have been backported to stable branches including 6.6.148, 6.12.101, 6.18.42, and 7.1.6. The Linux kernel CVE team formally announced CVE-2026-64564 on August 4, 2026, following private disclosure that began July 12.
System administrators running SCTP-enabled kernels, particularly in multi-tenant or containerized environments, should prioritize patching to the fixed kernel versions immediately given the demonstrated ease of exploitation and severity of impact.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
