Linux SCTP CVE-2026-64564 (SCTPhantom): 18-Year-Old Bug Gives Root and Container Escape

A use-after-free flaw in Linux's SCTP networking code, tracked as Linux SCTP CVE-2026-64564 and named SCTPhantom, lets a local user gain full root on a host, and Tencent researchers say they used it to escape a container and reach the machine underneath. The bug has existed since 2008 and is fixed in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148, released August 3, 2026. There is no public exploit yet and it is not in CISA's KEV catalog, but anyone running an older kernel with SCTP reachable should update now. Tencent Zhuque Lab reported getting root on kernel builds it tested for Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS.

The flaw is a mix-up over identity in SCTP's dynamic address reconfiguration feature, which lets a peer add or drop network paths mid-connection. The kernel checks a delete request against the packet's source address but then acts on a path it selected using a different address inside the message. Per the kernel's advisory, one crafted message can carry an address, a delete for that same address, and a wildcard delete in sequence: that frees the path and then reuses the dead pointer, leaving the connection pointed at memory the kernel has already released. The patch refuses a delete aimed at the path a message is currently being processed against. Disclosed publicly on August 6, two days after the kernel CVE team assigned it, SCTPhantom traces back to Linux 2.6.25 in 2008 and has ridden along in every kernel since.

This is also a textbook case of severity scoring lagging real risk. As of writing, the NVD entry carries no CVSS score at all, and EPSS sits near the 8th percentile. Neither number captures a local-root-plus-container-escape primitive on mainstream server distributions. For kernel and local-privilege-escalation bugs, the signal that matters is whether a working exploit exists and what it grants, not whether a scanner has caught up. Here, a nation-scale research lab has already demonstrated the escape.

Am I exposed if I do not run SCTP services?

Possibly, and that is what makes this worse than it looks. If the sctp kernel module is present on disk and module auto-loading is enabled, a local or containerized process can trigger it into memory by opening an SCTP socket, no running SCTP service required. That is why sysadmins reacting to the disclosure treated multi-tenant Kubernetes clusters, shared build servers, and any host running untrusted tenant containers as the high-urgency tier. The exposure is not "do we use SCTP" but "can an unprivileged workload reach it."

What can defenders do besides patch?

Patch first, but if you cannot reboot immediately, blocking the module is the standard mitigation. Preventing sctp from auto-loading (for example, install sctp /bin/true via a modprobe config) removes the attack surface on hosts that do not need the protocol, and tightening unprivileged user namespaces reduces the container-escape path. For detection, audit which hosts have the module loaded and watch for SCTP socket creation inside container namespaces with your runtime-security tooling.

Our read

Understanding risk means reading past the score. An 18-year-old use-after-free with a real container-escape demo and no CVSS number is the kind of exposure a compliance dashboard files under "informational" and an attacker files under "opportunity." Our review of 2025's actively exploited vulnerabilities found the median gap between disclosure and exploitation was 26 days, and local-privilege-escalation kernel bugs routinely beat that once exploit code circulates. Blacklist the module where you do not need it, patch to a fixed kernel where you do, and rank this by what it grants rather than what NVD has scored so far.

Reporting by The Hacker News; technical details per Tencent Zhuque Lab and the Linux kernel CVE advisory. Sources linked above.

Related: GhostLock CVE-2026-43499 Linux root container escape · Ubuntu snap-confine CVE-2026-8933 local root