Published on August 9, 2026
18-Year-Old Linux Kernel SCTP Vulnerability Lets Attackers Gain Full Root on Host
Severity
Critical
Detail
A high-severity Linux kernel vulnerability, tracked as CVE-2026-64564 and dubbed SCTPhantom, allows an unprivileged local attacker to escalate privileges to full root and, under specific conditions, escape a container and compromise the underlying host. The vulnerability is a use-after-free (UAF) flaw in the Linux kernel’s SCTP Dynamic Address Reconfiguration (ASCONF) functionality. The underlying vulnerable code dates back to Linux kernel 2.6.25, released in December 2007, making the root cause nearly 18 years old before its discovery.
The flaw exists in the handling of SCTP ASCONF chunks, which support adding, removing, and reconfiguring network paths within SCTP associations. The vulnerability results from an identity mismatch in how the kernel validates address deletion requests and maintains cached references to SCTP transports.
By crafting a specific sequence of ASCONF operations, an attacker can specify an address, delete that address, and subsequently issue a wildcard delete operation. This can cause the kernel to remove an SCTP transport while a stale reference to the freed transport remains in the association’s active and primary path pointers. A subsequent socket operation can then dereference the freed memory, triggering a use-after-free condition.
| CVE ID | Summary | CVSS Score |
| CVE-2026-64564 | Use-after-free vulnerability in the Linux kernel SCTP Dynamic Address Reconfiguration functionality that can allow an unprivileged local attacker to achieve full root privileges and, under specific conditions, escape a container to compromise the underlying host. | 9.8 (Critical) |
Affected Products
The vulnerability affects Linux kernel versions containing the vulnerable SCTP ASCONF implementation, including multiple kernel branches and distributions.
Tested vulnerable environments include:
- Linux kernel 5.14
- Linux kernel 6.x releases containing the vulnerable code
- Linux kernel 7.2 release candidate
- Ubuntu 24.04
- Debian 13
- Rocky Linux 9
- Other Linux distributions using affected kernel versions with SCTP functionality enabled
The vulnerable code originates from Linux kernel 2.6.25, although the practical impact depends on the kernel version, configuration, and whether SCTP functionality is available.
Recommendation
Organizations should implement the following measures to reduce the risk of exploitation:
- Upgrade affected Linux kernels immediately to a vendor-supported version containing the CVE-2026-64564 fix.
- Prioritize patching systems running SCTP, particularly servers, virtualization infrastructure, and multi-tenant environments.
- Review container hosts and workloads where unprivileged users or tenants may have access to SCTP functionality.
- Disable SCTP functionality on systems that do not require it.
- Review kernel and system logs for suspicious SCTP activity, unexpected privilege escalation, abnormal socket operations, or unexplained container exits.
Source
https://cybersecuritynews.com/18-year-old-linux-kernel-sctp-vulnerability/