- CVE-2026-64564 (SCTPhantom) is a use-after-free bug in Linux’s SCTP networking code that can escalate to full root access and container escape.
- The flaw has existed since 2008; fixes shipped August 3 in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148.
- Tencent Zhuque Lab demonstrated container escape achieving host root on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS.
- The local flaw requires SCTP reachable on the target; Tencent scored it 8.5 under CVSS v4.0.
- A second related use-after-free in the same code was patched August 6, after the stable releases shipped.
Tencent‘s Zhuque Lab disclosed a critical use-after-free vulnerability in Linux’s SCTP networking code on August 6, 2026, demonstrating it can escalate to full root and escape containers. Tracked as CVE-2026-64564 and named SCTPhantom, the flaw originated in Linux 2.6.25 back in 2008, and fixed kernels shipped August 3.
The vulnerability is local, not remote, and requires SCTP reachable on the target. However, where those conditions held, Tencent researchers achieved root on kernel builds for Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS.
The bug stems from an identity mix-up: the kernel checks a delete request against the packet’s source address but acts on a path selected using a different address. Per the NVD advisory, one message can carry an address, a delete for that same address, then a wildcard delete, freeing the path and reusing a dead pointer.
The patch refuses a delete aimed at the path being processed against. Tencent‘s write-up explains an early exploit required specific sysctls, but later found a route leaving them untouched by enabling features per socket.
The lab says its escape test kept the default seccomp profile without CAP_NET_ADMIN or CAP_SYS_ADMIN, with six of eight attempts reaching host root. However, no one outside the lab has reproduced the escape, and an openKylin advisory only reports kernel panic and denial of service.
Tencent scored the flaw 8.5 under CVSS v4.0, while NVD had not assigned a score as of August 7. Meanwhile, a second dangling-transport use-after-free in the same code was patched August 6, after the stable releases shipped.
The find came through Corvus AI, Tencent‘s multi-agent research pipeline, making SCTPhantom the latest long-dormant kernel flaw surfaced with machine assistance. It landed the same day as Zapscape, an unrelated KVM escape, with both fixes in the same four stable releases.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
