An 18-year-old use-after-free bug in the Linux kernel’s Stream Control Transmission Protocol (SCTP) stack, tracked as CVE-2026-64564 and nicknamed SCTPhantom, allows a local low-privilege user to gain root and, on container hosts, escape to the underlying machine.[2][4][15]
The flaw was uncovered by the TencentOS Server Security Team, which used its Corvus AI platform to identify a long-lived memory safety issue in SCTP’s Dynamic Address Reconfiguration code for Address Configuration (ASCONF) messages.[4][15] Tencent’s advisory states that the vulnerable logic was introduced around Linux kernel v2.6.25 in 2008 and persisted for more than 18 years across all subsequent v6-series kernels that include SCTP support.[15] In coordinated disclosures and technical write-ups, researchers demonstrated working exploits that elevate a normal user to root and pivot from containers to full host compromise in lab environments.[4][7]
CVE-2026-64564 arises in the sctp_process_asconf_param() function when processing carefully crafted ASCONF DEL-IP parameters, where the kernel fails to properly protect and validate the asconf->transport pointer before reusing it.[3][15] By sending an ordered sequence of address removal operations within a single ASCONF chunk, an attacker can first cause the kernel to free a transport path and then immediately reuse the dangling pointer, producing a use-after-free condition in the SCTP stack.[4][15] Rapid7’s summary of the issue describes the fix as ensuring that SCTP does not free the ASCONF message’s own transport during DEL-IP processing, eliminating the window in which attacker-controlled packets can steer the kernel into corrupting internal state.[14]
Advisories rate the vulnerability as high severity, with Cybersecurity Help assigning a CVSS v4 base score of 8.7, reflecting its ability to deliver local privilege escalation without elevated permissions or user interaction once SCTP is reachable.[3] Exploitation requires that the Linux kernel be compiled with SCTP support and that an attacker can send SCTP ASCONF traffic to the host—conditions that are increasingly common on multi-tenant servers and container platforms that expose SCTP-based services or load the SCTP module by default.[2][3][15] Tencent warns that TencentOS Server 2, 3 and 4 are among the affected distributions, but notes that the bug’s presence in mainline means any Linux system with vulnerable SCTP code and accessible transport paths is at risk until patched.[2][15]
The Linux kernel CVE team assigned CVE-2026-64564 on August 4, following upstream work to correct SCTP’s DEL-IP handling, and the fix is associated with kernel commit 9b2854f86f0b.[4][14] Maintainers have already shipped updates across multiple stable branches, with releases including 6.6.148, 6.12.101, 6.18.42 and 7.1.6 incorporating the patch, and additional mainline builds such as 7.2-rc5 also carrying the correction.[2][14] Vendor kernels are expected to backport the change to their supported long-term versions, and Tencent reports that its TencentOS Server products received fixes shortly after internal validation.[2][15]
Defenders operating Linux hosts or container platforms should treat SCTPhantom as a priority local privilege escalation issue, especially on systems where SCTP is loaded or exposed to untrusted tenants.[2][3][15] Security teams are urged to roll out the latest stable kernel updates or distribution backports, verify whether SCTP modules are active, and consider restricting SCTP access on multi-tenant infrastructure until patched builds are in production.[2][3][15] Given the availability of detailed exploitation guidance and proof-of-concept demonstrations from Tencent and independent researchers, organizations running older kernels with reachable SCTP stacks should assume that practical exploits will follow and act quickly to close the gap.[4][7][15]
References
- Linux SCTP bug lets local users hit root and escape containers
- SB2026080475 – Use-after-free in Linux kernel sctp
- SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free
- AI helped turn an 18-year-old flaw into a container escape | IntelFusions
- In the Linux kernel, the following vulnerability has been …
- Linux内核SCTPhantom 本地提权漏洞（CVE-2026-64564）
