A critical vulnerability in the Linux kernel, identified as CVE-2026-64564 and nicknamed ‘SCTPhantom,’ has been discovered, allowing attackers to escalate privileges from unprivileged local access to full root control. This flaw also enables container escapes, compromising the underlying host system.
The issue is a use-after-free bug within the kernel’s Stream Control Transmission Protocol (SCTP) Dynamic Address Reconfiguration feature. Remarkably, the root cause dates back to code introduced in Linux version 2.6.25 in December 2007, making this vulnerability nearly 18 years old before its detection.
SCTP, defined in RFC 5061, allows for dynamic reconfiguration of network paths through Address Configuration Change (ASCONF) chunks. The vulnerability arises from an identity mismatch during the handling of these chunks. Specifically, the kernel validates a DEL-IP (delete IP) operation using the packet’s source address, while a separate cached pointer relies on the address parameter used to select the actual network path, or transport.
By crafting a specific sequence of ASCONF chunks—such as specifying an address, deleting that same address, and then sending a wildcard delete—an attacker can trick the kernel into removing a transport while a stale reference to it remains in the association’s active and primary path pointers. Subsequent socket operations that dereference this freed memory create the use-after-free condition.
Security researchers at TencentOS Security Team utilized an autonomous vulnerability-research system called Corvus AI to develop a complete privilege-escalation exploit chain from this memory bug. The exploit reclaims the freed transport using a packet socket ring buffer, leaking a kernel memory address in the process. This leak enables a repeatable four-byte kernel read, which the researchers used to defeat Kernel Address Space Layout Randomization (KASLR) by inspecting the interrupt descriptor table.
From there, a second use-after-free is exploited with attacker-controlled SCTP authentication key data, allowing the attacker to build a fake kernel object graph that ultimately triggers commit_creds, granting global root privileges. Notably, this process does not require shellcode or a traditional Return-Oriented Programming (ROP) chain.
The researchers further demonstrated that the same flaw allows for container-to-host escapes. By using per-socket SCTP options instead of system-wide sysctls, the exploit avoids the need for elevated capabilities, successfully breaking out of containers running default seccomp profiles in six out of eight attempts. This ultimately triggers a usermode-helper process running in the host’s initial namespace.
The exploit chain was validated across various environments, including Ubuntu 24.04, Debian 13, Rocky Linux 9, and multiple kernel builds ranging from 5.14 to a 7.2 release candidate, achieving root access in every tested case.
Under the Common Vulnerability Scoring System (CVSS) v4.0, this flaw carries a base score of 8.5, rated as High severity, reflecting its combination of low attack complexity and high impact on confidentiality, integrity, and availability.
The upstream patch, merged as commit 9b2854f86f0b, addresses the issue by rejecting any DEL-IP request targeting the transport still referenced by the current ASCONF chunk. Fixes have been backported to stable branches, including versions 6.6.148, 6.12.101, 6.18.42, and 7.1.6. The Linux kernel CVE team formally announced CVE-2026-64564 on August 4, 2026, following private disclosure that began on July 12.
System administrators running SCTP-enabled kernels, particularly in multi-tenant or containerized environments, should prioritize updating to the fixed kernel versions immediately, given the demonstrated ease of exploitation and severity of impact.
This discovery underscores the importance of continuous code auditing and the potential longevity of vulnerabilities within complex systems. It also highlights the critical need for timely patching and the challenges posed by legacy code in maintaining system security.
