Full Report
A use-after-free bug in Linux's SCTP networking code can be turned into full root on a host, and Tencent researchers say they used it to escape a container and reach the machine underneath. The flaw has existed since 2008. The fix already shipped: stable kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148, released August 3, close it. Anyone running an older kernel with SCTP reachable should update.
Analysis Summary
# Vulnerability: SCTPhantom Use-After-Free in Linux SCTP
## CVE Details
- **CVE ID:** CVE-2026-64564
- **CVSS Score:** 8.5 (High) — *Tencent Score; NVD Pending*
- **CWE:** CWE-416 (Use After Free)
## Affected Systems
- **Products:** Linux Kernel
- **Versions:** All versions from Linux 2.6.25 (released in 2008) up to current stable releases prior to August 3, 2026.
- **Configurations:** Systems where the Stream Control Transmission Protocol (SCTP) module is loaded and reachable. Specifically, it impacts distributions including Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS.
## Vulnerability Description
SCTPhantom is a use-after-free vulnerability located in the Linux kernel's SCTP networking code. The flaw resides in the protocol's dynamic address reconfiguration feature. The kernel performs an identity check for a delete request against a packet's source address but subsequently acts on a path selected using a different address within the message.
By sending a specific sequence of messages—an address, a delete for that address, and then a wildcard delete—an attacker can cause the kernel to free a path and then reuse that dead pointer. This results in the connection pointing to memory that has already been released.
## Exploitation
- **Status:** PoC demonstrated by Tencent Zhuque Lab; no public exploit code or in-the-wild exploitation reported yet.
- **Complexity:** Medium (Requires specific socket-level configurations).
- **Attack Vector:** Local (Must have the ability to interact with SCTP sockets).
## Impact
- **Confidentiality:** High (Potential for full root access and container escape).
- **Integrity:** High (Ability to modify kernel-level memory).
- **Availability:** High (Can lead to kernel panics and denial of service).
## Remediation
### Patches
Update to the following stable kernel versions (released August 3, 2026) or newer:
- **7.1.6**
- **6.18.42**
- **6.12.101**
- **6.6.148**
*Note: A second related UAF bug was discovered on August 6; ensure you apply the latest available rolling updates from your distribution.*
### Workarounds
- **Disable SCTP:** If SCTP is not required for business operations, block or blacklist the `sctp` kernel module to eliminate the attack surface.
- **Socket Restrictions:** Restrict socket access and tighten seccomp profiles to limit the ability of untrusted processes to interact with SCTP.
## Detection
- **Indicators of Compromise:** Unusual kernel panics related to SCTP transport or unexpected privilege escalations from containerized environments.
- **Detection Methods:** Monitor for `net.sctp.addip_enable` sysctl changes, though the exploit can bypass this by enabling features per-socket. Audit system logs for SCTP-related memory errors using tools like KASAN (KernelAddressSanitizer) in testing environments.
## References
- **NVD Entry:** [https://nvd.nist.gov/vuln/detail/CVE-2026-64564](https://nvd.nist.gov/vuln/detail/CVE-2026-64564)
- **Tencent Research:** [https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564](https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564)
- **openKylin Advisory:** [https://bbs.openkylin.top/t/topic/173441](https://bbs.openkylin.top/t/topic/173441)
- **Kernel Patch:** [https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net-next/+/c9158ceaf27780ef64534ad72f44ffde3f8ccc49](https://kernel.googlesource.com/pub/scm/linux/kernel/git/netdev/net-next/+/c9158ceaf27780ef64534ad72f44ffde3f8ccc49)