FHN 
A newly discovered Linux kernel vulnerability, tracked as CVE-2026-64564 and named SCTPhantom, could allow attackers with local access to gain full root privileges. Security researchers also demonstrated that the flaw can be used to escape containers and compromise the underlying host system, making it a serious risk for Linux environments.
The vulnerability affects the Stream Control Transmission Protocol (SCTP) component of the Linux kernel. Surprisingly, the underlying flaw has existed since Linux 2.6.25, released in 2007, meaning it remained undiscovered for nearly 18 years.
How the Vulnerability Works
The issue is caused by a use-after-free memory bug in SCTP’s Dynamic Address Reconfiguration (ASCONF) feature.
By sending specially crafted SCTP packets in a specific sequence, an attacker can trick the kernel into freeing an object while it is still being referenced. When the kernel later tries to access that memory, it creates a use-after-free condition that can be exploited.
This flaw allows attackers to manipulate kernel memory and eventually execute privileged operations.
Privilege Escalation to Root
Researchers from TencentOS Security Team developed a working exploit that successfully turns the vulnerability into a full privilege-escalation attack.
Their exploit leaks kernel memory addresses, bypasses security protections such as Kernel Address Space Layout Randomization (KASLR), and creates fake kernel objects to obtain root privileges.
Notably, the attack does not rely on shellcode or traditional Return-Oriented Programming (ROP) techniques, making it more difficult for some security solutions to detect.
Container Escape Demonstrated
Researchers also proved that the vulnerability can be used to escape Linux containers.
Instead of requiring elevated system privileges, the exploit uses standard SCTP socket options available within containers. Once exploited, attackers can break out of the container environment and execute code on the underlying host.
This makes the vulnerability particularly concerning for organizations running containerized workloads or multi-tenant environments.
Follow Us on:Linkedin, Instagram, Facebook to get the latest security news!
Affected Systems
The exploit was successfully tested on several Linux distributions, including:
- Ubuntu 24.04
- Debian 13
- Rocky Linux 9
- Multiple Linux kernel versions from 5.14 through recent 7.x release candidates
The researchers achieved root access on every tested environment.
Severity and Impact
CVE-2026-64564 has received a CVSS v4.0 score of 8.5 (High).
If exploited successfully, attackers could:
- Gain full root privileges
- Escape container environments
- Compromise the underlying host
- Access sensitive data
- Modify system configurations
- Completely take control of affected Linux systems
Security Updates Available
The Linux kernel maintainers have released patches to address the vulnerability.
Fixes are available in the following kernel versions:
- 6.6.148
- 6.12.101
- 6.18.42
- 7.1.6
The vulnerability was officially disclosed on August 4, 2026, following responsible disclosure to the Linux kernel security team.
How Organizations Can Protect Their Systems
Organizations running Linux servers should prioritize applying the latest kernel updates, especially if SCTP is enabled.
Security teams should also:
- Apply the latest patched kernel versions.
- Monitor systems for unusual privilege-escalation attempts.
- Limit local user access wherever possible.
- Regularly review container security configurations.
- Monitor kernel and authentication logs for suspicious activity.
Conclusion
The discovery of SCTPhantom (CVE-2026-64564) highlights how critical vulnerabilities can remain hidden in widely used software for many years. With the ability to gain root access and escape containers, this flaw presents a significant security risk for Linux environments.
Organizations should update affected systems as soon as possible and strengthen monitoring to reduce the risk of exploitation.
About the Author
