18-year-old Linux SCTP bug allows root privileges

A use-after-free flaw in the Linux SCTP networking code can translate into full root access to a host, and Tencent researchers report that they used it to escape a container and reach the machine below.

See also: CVE-2026-23111: A character in the Linux kernel allows root access

The bug, tracked as CVE-2026-64564 and named SCTPhantom by its discoverers, was publicly disclosed on August 6, two days after being assigned by the kernel CVE team. No public exploit code had appeared at the time of writing, and The Hacker News did not find an entry for the bug in CISA's list of Known Exploitable Vulnerabilities until August 7.

The flaw is local, not remote, and requires Linux SCTP to be accessible on the target, which limits exposure. Where these conditions apply, Tencent Zhuque Lab reports gaining root access in kernel builds it tested for Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS.

SCTP is a transport protocol that allows a connection to operate over multiple network paths simultaneously. An accompanying feature, dynamic address reassignment, allows a peer to add or remove these addresses during the connection.

The bug is an identity confusion: the kernel checks a delete request against the packet's source address but acts on a path it chose using a different address within the message. According to the kernel advisory, a message can carry an address, a delete for the same address, and then a wildcard delete. This sequence frees the path, then reuses the dead pointer, leaving the connection pointing to memory that the kernel has already freed.

The fix denies a delete that targets the path that processes the message. The bug was discovered in Linux 2.6.25 in 2008 and is present in every kernel version released since then.

See also: CVE-2026-53264: AI helped develop Linux root exploit

Tencent's claim of container escape is based on its own testing. In its report, the lab says that an early version of the exploit required the sysctls net.sctp.addip_enable and net.sctp.addip_noauth_enable to be enabled, which made CAP_NET_ADMIN appear as a prerequisite. It later found a way to leave both intact by enabling the per-socket features.

The lab reports that its escape test retained the default seccomp profile and did not grant either CAP_NET_ADMIN or CAP_SYS_ADMIN. By its count, six out of eight attempts resulted in root on the host.

No one outside the lab has reproduced any of this, and the report does not mention the runtime of the container tested. The lab itself notes that socket access, seccomp profiles, and user-namespace policy shift the exposure elsewhere. An openKylin advisory covering the same bug doesn't go beyond a kernel panic and denial of service.

The severity number is also volatile. Tencent rated it 8.5 according to CVSS v4.0. NVD had not assigned a score or vulnerability classification as of August 7.

Vendors often roll back fixes without moving to a new upstream release, so a kernel version string alone won't tell you if you're covered. Check your distribution's tracker. A second dangling-transport use-after-free in the same code was fixed on August 6, after the August 3 stable releases, so those kernels don't carry it. Where Linux SCTP is not needed, hiding the module removes the attack surface entirely.

See also: GhostLock: 15-year-old Linux vulnerability for root access

Tencent attributes the discovery to Corvus AI, a multi-agent research pipeline it developed for kernel work, making SCTPhantom the latest in a string of long-dormant kernel bugs to surface with the help of machines this year, along with GhostLock in July. It also lands on the same day as Zapscape, an unrelated KVM exploit, and the same four stable releases carry fixes for both.