Linux Kernel SCTP Vulnerability Leaves Systems Vulnerable to Root-Level Compromise

Security researchers have disclosed a long-standing vulnerability in Linux's Stream Control Transmission Protocol (SCTP) implementation that can potentially be exploited by local attackers to obtain root-level privileges and, in some scenarios, escape from containerized environments to compromise the underlying host system.

The flaw, tracked as CVE-2026-64564 and nicknamed SCTPhantom, has reportedly existed within the Linux kernel since 2008, remaining undetected for nearly two decades. Security updates addressing the issue were released on August 3, 2026, and users running older kernel versions are strongly encouraged to update immediately if SCTP functionality is enabled or accessible.

Vulnerability Present Since Linux 2.6.25

The issue stems from a use-after-free vulnerability in Linux's SCTP networking subsystem. According to researchers from Tencent's Zhuque Lab, the flaw can be leveraged to achieve complete system compromise under certain conditions.

SCTP is a transport-layer protocol designed to provide capabilities beyond traditional TCP, including support for multiple network paths within a single connection. One of its features, known as Dynamic Address Reconfiguration (DAR), allows endpoints to add or remove network addresses during active sessions.

Researchers discovered that a logic flaw in the handling of address deletion requests can leave the kernel referencing memory that has already been freed.

In essence, the kernel validates one address but subsequently operates on a different address specified within the same message. By carefully crafting a sequence of SCTP control messages, an attacker can trigger a situation where a network path is released from memory but later referenced again by the system.

The resulting dangling pointer creates an opportunity for memory corruption and privilege escalation.

From Local Access to Root Privileges

Tencent researchers reported successfully exploiting the flaw to obtain root access on multiple Linux distributions, including:

• Debian 13
• Ubuntu 24.04
• Rocky Linux 9
• Red Hat Enterprise Linux 9 (RHEL 9)
• OpenCloudOS

The attack is not remotely exploitable and requires local access to the target system. Additionally, SCTP functionality must be available and reachable on the affected machine.

These requirements significantly reduce the exposure compared to internet-facing vulnerabilities, but environments where SCTP is enabled may still face serious risks.

Container Escape Demonstrated

Perhaps the most concerning aspect of the research is the claim that the vulnerability can be used to break out of containerized environments.

According to Tencent's testing, attackers were able to escalate privileges from within containers and gain root-level access on the host operating system.

Early versions of the exploit appeared to require SCTP-related kernel settings typically associated with elevated networking privileges. However, researchers later identified an alternative method that enabled exploitation without modifying those system-wide parameters.

The team reported that their container escape tests:

• Used the default seccomp profile
• Did not require CAP_NET_ADMIN
• Did not require CAP_SYS_ADMIN
• Successfully reached host-level root access in six out of eight attempts

If reproducible, this would demonstrate a potentially serious risk for containerized workloads relying on default security configurations.

Independent Verification Remains Limited

While Tencent has publicly documented its findings, independent confirmation of the container escape technique remains limited.

Researchers outside the laboratory have not yet publicly reproduced the exploit chain, and the published research does not specify the container runtime used during testing.

Some vendor advisories have taken a more conservative stance regarding the vulnerability's impact. For example, one advisory addressing the same flaw focused primarily on denial-of-service and kernel crash scenarios rather than privilege escalation or container breakout capabilities.

As a result, some aspects of the reported impact remain under active evaluation by the broader security community.

Security Patches Already Available

The Linux kernel community has released fixes for the vulnerability in multiple supported branches, including:

• Linux 7.1.6
• Linux 6.18.42
• Linux 6.12.101
• Linux 6.6.148

The patch prevents deletion operations from targeting the very network path currently being processed, eliminating the dangerous memory state that allowed the use-after-free condition to occur.

Because many Linux distributions backport security fixes without changing major kernel version numbers, administrators should verify patch status through their vendor's security advisories rather than relying solely on kernel version strings.

No Evidence of Active Exploitation

At the time of disclosure:

• No public proof-of-concept exploit had been released.
• The vulnerability was not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
• No reports of active in-the-wild exploitation had been publicly confirmed.

The vulnerability was formally assigned a CVE by the Linux kernel security team on August 4, 2026, and publicly disclosed shortly afterward.

Additional SCTP Issues Discovered

Researchers noted that a second SCTP-related use-after-free issue was patched separately after the initial stable Linux releases were published.

As a result, organizations should ensure they are applying the latest available vendor updates rather than assuming that the first round of patches addresses every SCTP-related issue.

Mitigation Recommendations

Organizations should take the following steps:

• Apply the latest Linux kernel security updates immediately.
• Verify patch status through vendor advisories.
• Audit systems where SCTP is enabled.
• Disable or block SCTP if it is not required.
• Review container environments for SCTP exposure.
• Monitor for unexpected SCTP activity and kernel anomalies.

Where SCTP is unnecessary, disabling the protocol entirely may be the most effective way to eliminate the attack surface.

AI-Assisted Discovery Highlights Emerging Trend

Tencent credited discovery of the vulnerability to Corvus AI, a multi-agent security research platform developed to analyze Linux kernel code. The finding adds to a growing number of long-dormant vulnerabilities uncovered through AI-assisted security research in recent months.

The emergence of tools capable of identifying hidden flaws in mature codebases suggests that additional legacy vulnerabilities may still be waiting to be discovered across critical open-source infrastructure.

Conclusion

CVE-2026-64564 demonstrates how a subtle bug can remain embedded in widely used software for years before being uncovered. While exploitation requires local access and SCTP availability, researchers have shown that the flaw may enable root privilege escalation and potentially allow attackers to escape container environments. With security fixes now available, organizations running Linux systems should prioritize patching and review whether SCTP is truly required within their environments.