18-Year-Old Linux SCTP Flaw Allows Local Privilege Escalation and Container Escape
A long-standing use-after-free vulnerability in Linux's SCTP networking code, present since 2008, has been demonstrated by researchers to allow local users to gain root privileges and escape containerized environments.
An 18-year-old use-after-free vulnerability lurking in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation has been weaponized by researchers to achieve full root privileges on a host system and to break out of containerized environments. The flaw, tracked as CVE-2026-64564 and dubbed SCTPhantom by its discoverers at Tencent's Zhuque Lab, has existed in the kernel since 2008 and was publicly disclosed on August 6, 2026.
The vulnerability stems from a complex interaction within SCTP's dynamic address reconfiguration feature. Specifically, the kernel mishandles identity checks during delete requests for network paths. The bug occurs when the kernel checks a delete request against one source address but then acts upon a path identified by a different address within the same message. This sequence can lead to a path being freed, followed by a reuse of a dangling pointer, causing the connection to point to already released memory, ultimately leading to a use-after-free condition.
Tencent researchers successfully demonstrated that this flaw could be exploited by local users to gain root privileges on several popular Linux distributions, including Debian 13, Ubuntu 24.04, Rocky Linux 9, and RHEL 9. Their container escape exploit, after initial refinements, achieved a success rate of six out of eight attempts on tested kernel builds, even without requiring elevated privileges like CAP_NET_ADMIN or CAP_SYS_ADMIN, and while maintaining default seccomp profiles.
While the vulnerability requires SCTP to be reachable on the target system and is local in nature, its potential impact is significant for systems running vulnerable kernel versions. The fix for SCTPhantom was included in stable kernel releases on August 3, 2026, specifically versions 7.1.6, 6.18.42, 6.12.101, and 6.6.148. However, users are advised to check their distribution's specific kernel trackers, as vendors often backport fixes without necessarily updating to a new upstream version number.
At the time of reporting, no public exploit code had been released, and the vulnerability had not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. The severity score assigned by Tencent under CVSS v4.0 was 8.5, though NVD had not yet assigned a score or weakness classification. An advisory from openKylin noted the bug could lead to kernel panics and denial of service, but did not detail privilege escalation or container escape capabilities.
This discovery highlights the ongoing challenge of maintaining kernel security, especially with long-dormant flaws. Tencent credits its Corvus AI research pipeline for surfacing SCTPhantom, marking another instance this year where machine assistance has uncovered deeply embedded kernel vulnerabilities. Notably, the same stable kernel releases that patched SCTPhantom also addressed Zapscape, an unrelated KVM escape vulnerability, underscoring a busy period for Linux kernel security.
For systems where SCTP is not required, administrators can mitigate the risk by blocking the SCTP kernel module entirely. A second, related dangling-transport use-after-free vulnerability in the same code was patched on August 6, 2026, meaning the August 3 stable releases do not contain this latter fix.
The long lifespan of this vulnerability, coupled with its potential for severe impact including container escapes, serves as a stark reminder for organizations to maintain rigorous patch management and to continuously audit their systems for known and unknown security weaknesses, especially in foundational components like the operating system kernel.