A newly disclosed Linux kernel vulnerability, dubbed SCTPhantom and tracked as CVE-2026-64564, permits attackers to escalate from unprivileged native entry to full root and even escape containers to compromise the underlying host.
The flaw is a use-after-free bug within the kernel’s SCTP Dynamic Handle Reconfiguration characteristic, and remarkably, its root trigger traces again to code launched in Linux 2.6.25 in December 2007, making it almost 18 years previous earlier than discovery.
The vulnerability lives in how the kernel handles ASCONF chunks, a mechanism outlined in RFC 5061 that lets SCTP associations add, take away, or reconfigure community paths on the fly.
The bug stems from an identification mismatch: the kernel validates a DEL-IP delete operation utilizing the packet’s supply deal with, whereas a separate cached pointer depends on the deal with parameter used to pick out the precise community path, or transport.
By crafting an ordered ASCONF sequence, comparable to specifying an deal with, deleting that very same deal with, after which sending a wildcard delete, an attacker can trick the kernel into eradicating a transport whereas a stale reference to it lingers within the affiliation’s lively and first path pointers. A later socket operation then dereferences this freed reminiscence, creating the use-after-free situation.
Safety researchers at TencentOS Safety Crew, utilizing an autonomous vulnerability-research system known as Corvus AI, turned this uncooked reminiscence bug into a whole privilege-escalation chain. The exploit reclaims the freed transport utilizing a packet socket ring buffer, leaking a kernel reminiscence deal with within the course of.
That leak permits a repeatable four-byte kernel learn, which researchers used to defeat KASLR by inspecting the interrupt descriptor desk. From there, a second use-after-free is exploited with attacker-controlled SCTP authentication key information, permitting the attacker to construct a faux kernel object graph that in the end triggers commit_creds and palms over world root privileges, all with out shellcode or a standard ROP chain.
The researchers went further, demonstrating that the identical flaw permits container-to-host escape. Through the use of per-socket SCTP choices as an alternative of system-wide sysctls, the exploit averted needing elevated capabilities, efficiently breaking out of containers operating default seccomp profiles in six of eight makes an attempt, in the end triggering a usermode-helper course of operating within the host’s preliminary namespace.
The exploit chain was validated throughout a variety of environments, together with Ubuntu 24.04, Debian 13, Rocky Linux 9, and a number of kernel builds starting from 5.14 to a 7.2 launch candidate, attaining root in each examined case.
Below CVSS v4.0, the flaw carries a base rating of 8.5, rated Excessive severity, reflecting its mixture of low assault complexity and excessive affect on confidentiality, integrity, and availability.
The upstream patch, merged as commit 9b2854f86f0b, closes the hole by rejecting any DEL-IP request focusing on the transport nonetheless referenced by the present ASCONF chunk.
Fixes have been backported to steady branches together with 6.6.148, 6.12.101, 6.18.42, and seven.1.6. The Linux kernel CVE crew formally introduced CVE-2026-64564 on August 4, 2026, following non-public disclosure that started July 12.
System directors operating SCTP-enabled kernels, notably in multi-tenant or containerized environments, ought to prioritize patching to the fastened kernel variations instantly given the demonstrated ease of exploitation and severity of affect.
Strengthen Your SOC by Accelerating Menace Detection & Speedy Investigations. -> Integrate ANY.RUN With Your SOC Now.
