An 18-year-old vulnerability in the Linux kernel’s Stream Control Transmission Protocol (SCTP) implementation has been identified, potentially allowing local users to gain root privileges and escape containerized environments. This use-after-free flaw, designated as CVE-2026-64564 and dubbed ‘SCTPhantom,’ has been present since 2008 and affects all kernel versions from 2.6.25 onward.
SCTP is a transport protocol that enables multi-homing and multi-streaming capabilities, allowing a single connection to operate over multiple network paths simultaneously. A feature within SCTP, dynamic address reconfiguration, permits peers to add or remove addresses during an active connection. The vulnerability arises from improper handling of delete requests for these addresses. Specifically, the kernel checks a delete request against the packet’s source address but acts on a path selected using a different address within the message. This discrepancy can lead to the reuse of freed memory, resulting in a use-after-free condition.
The flaw was discovered by Tencent’s Zhuque Lab, which reported successful exploitation to achieve root access on various Linux distributions, including Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS. Notably, the researchers demonstrated that the vulnerability could be exploited to escape containerized environments, even with default seccomp profiles and without CAP_NET_ADMIN or CAP_SYS_ADMIN capabilities. In their tests, six out of eight attempts resulted in root access on the host machine.
To address this critical issue, the Linux kernel team released patches on August 3, 2026, in stable kernel versions 7.1.6, 6.18.42, 6.12.101, and 6.6.148. Users and administrators are strongly advised to update their systems to these patched versions to mitigate the risk. For those who do not require SCTP functionality, disabling the SCTP module can serve as an additional protective measure by eliminating the attack surface.
It’s important to note that, as of August 7, 2026, no public exploit code for this vulnerability has been observed, and it has not been listed in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities catalog. However, given the severity and potential impact of this flaw, prompt action is recommended.
This discovery underscores the importance of continuous security assessments and timely patching in maintaining system integrity. The longevity of this vulnerability highlights the challenges in identifying and addressing deep-seated flaws within complex systems. Organizations should remain vigilant, regularly update their systems, and consider implementing additional security measures to protect against potential exploits.
