An almost 18-year-old vulnerability in the Linux kernel lets local attackers gain root privileges and escape containers onto the host. Dubbed “SCTPhantom” (CVE-2026-64564), it sits in the SCTP networking code and was disclosed on 4 August 2026.
A bug from 2007
The flaw is a use-after-free bug in the SCTP module, specifically in its dynamic address reconfiguration function. The underlying code was introduced back in Linux 2.6.25 in December 2007, so it went undiscovered for nearly 18 years. The root cause is an identity mismatch in address processing: one validation step relies on the packet’s source address, while a cached pointer uses the address parameter of the selected network path.
From local access to full root
The impact is severe: unprivileged local access can be escalated to full root – and even to a container escape onto the underlying host. Tencent’s Zhuque Lab, which found the bug, gained root on tested kernel builds for Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9 and OpenCloudOS.
Fixes are available
Fixes have been backported to the stable branches, including kernels 6.6.148, 6.12.101, 6.18.42 and 7.1.6. Operators should apply their distribution updates promptly. Anyone who does not need SCTP can additionally block the kernel module to reduce the attack surface.
Sources: The Hacker News, Red Hat.
