A Linux SCTP flaw dating to 2008 could allow local privilege escalation and potentially container escapes, researchers warn.

A security vulnerability in the Linux kernel dating back to 2008 could allow local attackers to escalate privileges to root and, under certain conditions, escape containers, according to researchers at Tencent’s Zhuque Lab.

Tracked as CVE-2026-64564 and dubbed SCTPhantom, the vulnerability is a use-after-free flaw in the Linux Stream Control Transmission Protocol (SCTP) networking code. The affected code was introduced in Linux 2.6.25 nearly 18 years ago and has remained in subsequent kernel versions.

Tencent researchers reported successfully exploiting the vulnerability to obtain root privileges on several Linux distributions, including Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9 and OpenCloudOS.

The flaw is classified as a local security issue rather than a remotely exploitable vulnerability. An attacker must already have local access to the affected system, while the relevant SCTP functionality must also be accessible. These requirements limit the circumstances in which the vulnerability can be exploited.

The underlying issue affects SCTP’s Dynamic Address Reconfiguration (ASCONF) functionality. Researchers found that specially crafted address configuration requests can cause the Linux kernel to free an SCTP transport object while another part of the code can still reference the released memory.

That creates a dangling pointer that can potentially be manipulated to cause memory corruption and ultimately gain elevated privileges.

Tencent also reported successfully using the vulnerability in testing to escape a container and obtain root access on the underlying host. The researchers said they retained the default seccomp profile and did not grant the container CAP_NET_ADMIN or CAP_SYS_ADMIN privileges.

However, the container-escape result should be treated as a researcher-reported finding rather than an independently reproduced result. Tencent said six of eight attempts in its testing successfully reached root on the host. Exploitability can vary depending on factors including socket access, seccomp configuration and user-namespace policies.

The vulnerability was publicly disclosed on August 6, 2026, after the Linux kernel CVE team assigned it the identifier CVE-2026-64564. At the time of disclosure, there was no known public exploit code, and the flaw had not been listed in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.

Upstream fixes were included in stable Linux kernel releases 6.6.148, 6.12.101, 6.18.42 and 7.1.6, which were released on August 3. Version 7.2-rc5 was also listed as fixed.

Administrators should check their Linux distribution’s security advisories rather than relying solely on the kernel version displayed by a system. Linux distributions frequently backport security fixes while retaining an older upstream version number.

Systems that do not require SCTP can also reduce their exposure by disabling or blocking the SCTP kernel module, where appropriate.

SCTPhantom highlights the security risks posed by long-standing flaws in mature operating-system components. While the vulnerability requires local access and specific conditions, successful exploitation could have serious consequences on affected systems, particularly where vulnerable SCTP functionality is exposed.

Source: Hacker News

Related articles :

__Reports are sourced from official documents, law-enforcement updates, and credible investigations.

Discover additional reports, market trends, crime analysis and Harm Reduction articles on DarkDotWeb to stay informed about the latest dark web operations.__

18-Year-Old Linux Flaw Could Enable Root Access