CVE-2026-64564: 18-Year Linux SCTP Flaw Enables Root & Container Escape

A critical 18-year-old use-after-free vulnerability in the Linux kernel's SCTP networking stack, dubbed "SCTPhantom" and tracked as CVE-2026-64564, can grant local users root privileges and enable container escapes, according to researchers at Tencent Zhuque Lab. The flaw was disclosed publicly on August 6, 2026—just two days after the kernel CVE team assigned the identifier—and has lurked undetected since Linux 2.6.25 was released in 2008. Patches shipped in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148 on August 3, and administrators should upgrade immediately if their distribution has not yet backported the fix.

The bug resides in SCTP's dynamic address reconfiguration feature, which lets peers add or drop network paths mid-connection. According to the kernel advisory, a single SCTP message can deliver an address, a delete request for that same address, and a wildcard delete in sequence—freeing a path object and then reusing the now-dangling pointer. The patch rejects delete requests targeting the path currently being processed. Tencent's write-up reports that researchers exploited the bug to escalate from a confined container to full root on the underlying host, succeeding in six of eight attempts against builds of Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS. Their exploit deliberately kept the default seccomp profile, requested neither CAP_NET_ADMIN nor CAP_SYS_ADMIN, and avoided globally enabling net.sctp.addip_enable or net.sctp.addip_noauth_enable by activating the features per socket instead.

The vulnerability is local rather than remote and requires SCTP to be reachable on the target, which narrows the attack surface. Tencent scored it 8.5 under CVSS v4.0, though NVD had not yet assigned a severity or weakness classification as of August 7. No public exploit code has surfaced, and CISA's Known Exploited Vulnerabilities catalog does not list the flaw. The first step for defenders is confirming whether SCTP is actually exposed on host interfaces—a quick pass with a port scanner can reveal any open SCTP listeners, since the attack is moot if the protocol is not reachable. An openKylin advisory covering the same bug stops at kernel panic and denial of service, suggesting exploitability varies by configuration.

Because vendors often backport fixes without bumping the upstream kernel version string, a version number alone is not a reliable indicator of patch status—always verify against your distribution's security bulletin. Until patched, security teams should audit which workloads depend on SCTP, lock down socket access, and revisit seccomp and user-namespace policies that govern container trust boundaries. For a broader review of the host's exposure, a full privacy checkup can help surface additional weak spots across the environment. Any confirmed container-escape capability should be treated as a prompt to revalidate isolation guarantees and apply the kernel update as soon as it becomes available.