18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers

Summary: A use-after-free flaw in Linux's SCTP networking code, present since kernel 2.6.25 in 2008, was disclosed publicly on August 6 as CVE-2026-64564 and named SCTPhantom by Tencent Zhuque Lab, which reported gaining root on tested builds of Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9 and OpenCloudOS. The bug lets one message carry an address, a delete for that address, then a wildcard delete, freeing a path and reusing the dead pointer; fixes shipped August 3 in stable kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148.
What you should know: Tencent's lab says six of eight container-escape attempts reached root on the host while keeping the default seccomp profile and granting neither CAP_NET_ADMIN nor CAP_SYS_ADMIN - and no one outside the lab has reproduced it, with NVD still carrying no score or weakness classification as of August 7.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-64564
Related: ⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026