18-Year-Old Linux SCTP Flaw CVE-2026-64564 Could Let Local Users Gain Root and Escape Containers

A use-after-free vulnerability in Linux’s SCTP networking code, tracked as CVE-2026-64564 and named SCTPhantom, could allow local users to gain root privileges and escape containers. The flaw has existed since 2008 and was publicly disclosed on August 6, 2026. Tencent Zhuque Lab researchers demonstrated a container escape on multiple distributions, including Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS. The vulnerability requires local access and SCTP reachable on the target, limiting remote exposure. Patches have been released in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148, shipped on August 3. A second related use-after-free in the same code was patched on August 6. Tencent scored the flaw 8.5 under CVSS v4.0, while NVD had not yet assigned a score. No public exploit code has surfaced, and CISA’s KEV catalog does not list it. The bug involves a mix-up in address handling during dynamic address reconfiguration, leading to a freed path pointer being reused. The patch prevents deletion of the path being processed. Tencent credits the discovery to its Corvus AI research pipeline, which has also surfaced other long-dormant kernel flaws. Users are advised to update kernels or disable SCTP if not needed.