Critical 18-Year-Old Linux Kernel Flaw (CVE-2026-64564) Enables Root Access and Container Escapes
A severe use-after-free vulnerability in the Linux kernel, dubbed SCTPhantom (CVE-2026-64564), has been disclosed, allowing attackers with unprivileged local access to escalate to root privileges or escape containers to compromise the host system. The flaw, introduced in Linux 2.6.25 (December 2007), remained undetected for nearly 18 years before its discovery.
The bug resides in the SCTP Dynamic Address Reconfiguration feature, specifically in how the kernel processes ASCONF chunks a mechanism defined in RFC 5061 for managing network paths in SCTP associations. The vulnerability stems from an identity mismatch in address validation: while the kernel checks a DEL-IP operation using the packet’s source address, a cached pointer relies on the address parameter tied to the actual network path. By crafting a malicious ASCONF sequence (e.g., adding, deleting, and then wildcard-deleting an address), attackers can force the kernel to dereference freed memory, triggering a use-after-free condition.
Researchers at TencentOS Security Team, leveraging their Corvus AI autonomous vulnerability research system, developed a full privilege-escalation exploit chain. The attack begins by reclaiming the freed memory via a packet socket ring buffer, leaking a kernel memory address to bypass KASLR (Kernel Address Space Layout Randomization). A second use-after-free, combined with SCTP authentication key manipulation, constructs a fake kernel object graph, ultimately executing commit_creds to grant root access all without traditional shellcode or ROP chains.
The exploit also enables container-to-host escapes, bypassing default seccomp profiles by leveraging per-socket SCTP options instead of system-wide sysctls. Testing across Ubuntu 24.04, Debian 13, Rocky Linux 9, and kernels from 5.14 to 7.2, the attack succeeded in all environments, including six of eight container escape attempts.
With a CVSS v4.0 base score of 8.5 (High), the flaw poses significant risk due to its low attack complexity and severe impact on confidentiality, integrity, and availability. A patch (commit 9b245f86f0b) was merged upstream, rejecting DEL-IP requests targeting transports still referenced by active ASCONF chunks. Fixes have been backported to stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6), and CVE-2026-64564 was formally announced on August 4, 2026, following private disclosure on July 12.
Systems running SCTP-enabled kernels, particularly in multi-tenant or containerized environments, are urged to apply updates immediately.
Source: https://cybersecuritynews.com/18-year-old-linux-kernel-sctp-vulnerability/
Kernel Foundation - Master Linux Kernel & LDD cybersecurity rating report: https://www.rankiteo.com/company/linux-kernel-foundation
Rocky Linux cybersecurity rating report: https://www.rankiteo.com/company/rockylinux
Ubuntu cybersecurity rating report: https://www.rankiteo.com/company/ubuntu-linux
Debian cybersecurity rating report: https://www.rankiteo.com/company/debian
"id": "LINROCUBUDEB1786123420",
"linkid": "linux-kernel-foundation, rockylinux, ubuntu-linux, debian",
"type": "Vulnerability",
"date": "8/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Systems running SCTP-enabled '
'kernels, particularly in '
'multi-tenant or containerized '
'environments',
'industry': 'Technology/Operating Systems',
'location': 'Global',
'name': 'Linux Kernel',
'type': 'Software'}],
'attack_vector': 'Local',
'date_detected': '2026-07-12',
'date_publicly_disclosed': '2026-08-04',
'description': 'A severe use-after-free vulnerability in the Linux kernel, '
'dubbed SCTPhantom (CVE-2026-64564), allows attackers with '
'unprivileged local access to escalate to root privileges or '
'escape containers to compromise the host system. The flaw, '
'introduced in Linux 2.6.25 (December 2007), remained '
'undetected for nearly 18 years. The bug resides in the SCTP '
'Dynamic Address Reconfiguration feature, enabling memory '
'corruption via crafted ASCONF sequences.',
'impact': {'operational_impact': 'Root access compromise, container-to-host '
'escapes',
'systems_affected': 'Linux kernels 2.6.25 to 7.2 (Ubuntu 24.04, '
'Debian 13, Rocky Linux 9, etc.)'},
'investigation_status': 'Patched and disclosed',
'lessons_learned': 'Long-standing vulnerabilities in critical kernel '
'components can remain undetected for decades, posing '
'severe risks to security. Autonomous vulnerability '
'research systems (e.g., Corvus AI) can accelerate '
'discovery. Containerized environments are particularly '
'vulnerable to kernel-level exploits.',
'post_incident_analysis': {'corrective_actions': 'Kernel patch to reject '
'DEL-IP requests targeting '
'transports still referenced '
'by active ASCONF chunks. '
'Backported fixes to stable '
'branches.',
'root_causes': 'Identity mismatch in SCTP ASCONF '
'chunk processing leading to '
'use-after-free. Lack of validation '
'for DEL-IP operations on '
'referenced transports.'},
'recommendations': 'Immediately apply kernel patches for CVE-2026-64564. '
'Audit systems for SCTP usage and disable if unnecessary. '
'Strengthen container security with updated seccomp '
'profiles and kernel hardening. Monitor for signs of '
'exploitation in multi-tenant environments.',
'references': [{'source': 'TencentOS Security Team'},
{'source': 'Linux Kernel Mailing List (Patch Commit '
'9b245f86f0b)'},
{'source': 'CVE-2026-64564 Advisory'}],
'response': {'containment_measures': 'Patch released (commit 9b245f86f0b) to '
'reject DEL-IP requests targeting '
'referenced transports',
'remediation_measures': 'Apply kernel updates (6.6.148, '
'6.12.101, 6.18.42, 7.1.6)'},
'stakeholder_advisories': 'Systems running SCTP-enabled kernels, especially '
'in containerized environments, should apply '
'updates immediately.',
'title': 'Critical 18-Year-Old Linux Kernel Flaw (CVE-2026-64564) Enables '
'Root Access and Container Escapes',
'type': 'Privilege Escalation, Container Escape',
'vulnerability_exploited': 'Use-after-free in SCTP Dynamic Address '
'Reconfiguration (ASCONF chunks)'}