SCTPhantom, tracked as CVE-2026-64564, is a high-severity Linux kernel use-after-free vulnerability in the Stream Control Transmission Protocol (SCTP) Dynamic Address Reconfiguration implementation.
Researchers at Tencent Zhuque Lab’s Corvus AI project reported that a local attacker could leverage the flaw to escalate privileges to root and, in certain configurations, to escape from containers to the host.
The issue affects SCTP’s ASCONF (Address Configuration Change) handling logic. SCTP supports multihoming, allowing one association to maintain multiple network paths.
18-Year-Old Linux Kernel SCTP Vulnerability
Linux tracks those paths with struct sctp_transport objects, while association-level pointers such as primary_path and active_path are expected to reference valid, live transports.
SCTPhantom occurs when SCTP processes a crafted, ordered ASCONF sequence that causes a transport object to be removed while a stale reference to it remains in the association. Subsequent socket operations can then access the freed object, producing a use-after-free condition.
The root cause lies in inconsistent identity handling during the DEL-IP operation. The vulnerable flow differentiates between the IPv4 packet source address and the SCTP Address Parameter used to select a peer transport.
An attacker-controlled ASCONF message can reportedly use one address for source validation and another to select the transport involved in later processing.
A carefully ordered sequence of deletion operations can remove the selected transport, then cause a wildcard deletion path to reuse its cached pointer. This leaves primary_path and active_path potentially pointing to freed memory.
The bug is particularly notable because the relevant wildcard-handling behavior dates back to Linux 2.6.25, making SCTPhantom an approximately 18-year-old vulnerability.
Exploitation still depends on local access and environmental conditions, including SCTP availability and the ability to reach relevant socket functionality.
Corvus AI researchers developed the crash into a demonstrated local privilege-escalation chain on multiple tested Linux distributions and kernel versions.
Their research used controlled heap reallocation and a stale SCTP path reference to obtain a kernel memory disclosure and subsequently manipulate kernel object relationships.
Rather than relying on conventional user-space shellcode or a return-oriented programming chain, the reported technique uses existing kernel code paths to invoke credential-changing functionality.
Tencent validated successful compromise through root-only filesystem access and creation of root-owned files. Tested systems reportedly included Debian 13, Ubuntu 24.04, Rocky Linux 9/RHEL 9-derived systems, OpenCloudOS-family targets, and a Linux 7.2 release candidate.
Vendor-specific kernel backports mean administrators should not rely solely on the displayed kernel version when assessing exposure. The researchers also demonstrated a container-to-host escape in a tested configuration.
Because containers share the host kernel, a successful SCTP kernel exploit from within a container may compromise the underlying host rather than remaining isolated inside the container namespace. The documented test retained a default seccomp profile and did not grant the container CAP_NET_ADMIN or CAP_SYS_ADMIN.
However, exposure varies substantially by deployment: SCTP support, packet-socket permissions, user namespace settings, Linux Security Module policy, container runtime restrictions, and host kernel patch status all influence practical exploitability.
Mitigation
Linux upstream fixed the flaw in commit 9b2854f86f0b, which rejects deletion of the transport retained for the ASCONF chunk. First fixed releases include Linux 6.6.148, 6.12.101, 6.18.42, 7.1.6, and mainline 7.2-rc5.
Organizations should promptly apply their distribution’s kernel update, verify vendor backport status, and reboot affected hosts. As a defense-in-depth measure, administrators should disable SCTP where it is not required, restrict untrusted local workloads, and review container policies that expose network and packet-socket capabilities.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
