● Covered by 1 source · 1 reportMedium impact1 negative
Linux SCTP Flaw Allows Local Root Privilege Escalation and Container Escape
Key points
- SCTP use-after-free vulnerability (CVE-2026-64564) found in Linux kernel.
- Flaw allows local root privilege escalation and container escape.
- Tencent Zhuque Lab demonstrated exploit on various Linux distributions.
- Patches released in Linux kernel versions 7.1.6, 6.18.42, 6.12.101, and 6.6.148.
SCTP Vulnerability Discovered
A use-after-free bug, tracked as CVE-2026-64564 and named SCTPhantom, has been identified in the Linux kernel's SCTP networking code. This flaw allows a local user to achieve full root privileges on a host system. Tencent researchers successfully used this vulnerability to escape a container and gain access to the underlying machine.
Long-Standing Flaw and Patch Availability
The vulnerability has been present in the Linux kernel since version 2.6.25, released in 2008. The fix for this issue has already been shipped in stable kernel updates, specifically versions 7.1.6, 6.18.42, 6.12.101, and 6.6.148, all released on August 3. Users running older kernels with SCTP enabled are advised to update immediately.
Exploitation Details and Impact
The flaw is local, requiring SCTP to be reachable on the target system, which limits its exposure. Tencent Zhuque Lab reported achieving root on tested kernel builds for Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS. The bug stems from a mix-up in identity during dynamic address reconfiguration, where the kernel checks a delete request against a packet's source address but acts on a path picked using a different address, leading to a use-after-free condition.
Tencent's container escape demonstration involved bypassing default seccomp profiles and not requiring CAP_NET_ADMIN or CAP_SYS_ADMIN capabilities. The lab reported a high success rate in achieving root on the host during its tests, though the specific container runtime used was not named, and external reproduction has not been confirmed.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
A use-after-free vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) networking code, present since 2008, allows local users to gain root privileges and escape containers. Tencent researchers demonstrated the exploit, and fixes have been released in recent stable kernel versions.