← Back to Feed

18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers

CVE-2026-64564

August 7, 2026 · The Hacker News · Severity: HIGH

A critical 18-year-old vulnerability in Linux’s SCTP networking protocol, tracked as CVE-2026-64564 and dubbed SCTPhantom, allows local attackers to escalate privileges to root and escape containers. Discovered by Tencent’s Zhuque Lab, the flaw stems from a use-after-free bug in the SCTP code, which mishandles address deletions during dynamic address reconfiguration. This issue, present since Linux kernel 2.6.25 in 2008, affects systems running older kernels with SCTP enabled, including Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS. Patches were released in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148 on August 3, but users must verify their distributions’ updates to ensure protection. The vulnerability requires local access and SCTP to be reachable, limiting its exposure but posing significant risks in affected environments. Tencent demonstrated the flaw’s potential by escaping containers and gaining root access on the host machine in six out of eight attempts, even without requiring CAP_NET_ADMIN or CAP_SYS_ADMIN privileges. While no public exploit code has been reported, the flaw’s severity remains contested, with Tencent assigning it a CVSS v4.0 score of 8.5. Organizations using SCTP should update their kernels or disable the SCTP module to mitigate the risk. This discovery highlights the ongoing challenges of identifying and patching long-dormant vulnerabilities in complex systems like Linux.

A use-after-free bug in Linux's SCTP networking code can be turned into full root on a host, and Tencent researchers say they used it to escape a container and reach the machine underneath. The flaw has existed since 2008. The fix already shipped: stable kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148, released August 3, close it. Anyone running an older kernel with SCTP reachable should update. Tracked as CVE-2026-64564 and named SCTPhantom by its finders, the flaw was disclosed publicly on August 6, two days after the kernel CVE team assigned it. No public exploit code had surfaced at the time of writing, and The Hacker News found no entry for the flaw in CISA's Known Exploited Vulnerabilities catalog as of August 7. The flaw is local, not remote, and it needs SCTP reachable on the target, which limits exposure. Where those conditions held, Tencent Zhuque Lab reports it got root on the kernel builds it tested for Debian 13, Ubuntu 24.04, Rocky Linux 9 and RHEL 9, and OpenCloudOS.

Key Takeaways

  • An 18-year-old use-after-free vulnerability in Linux's SCTP protocol (CVE-2026-64564) allows local privilege escalation to root and container escape.
  • The flaw affects Linux kernels since 2.6.25 (2008), impacting Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS.
  • Patches released in stable kernels 6.6.148, 6.12.101, 6.18.42, and 7.1.6 — administrators should update or disable SCTP immediately.
☕ Buy a Coffee