A newly disclosed Linux kernel vulnerability, dubbed SCTPhantom, allows local attackers to escalate privileges to root and break out of containers by exploiting an 18-year-old flaw in SCTP’s Dynamic Address Reconfiguration (ASCONF) code.
The bug, tracked as CVE-2026-64564, carries a CVSS v4.0 base score of 8.5 (High) and has been fixed upstream via kernel commit 9b2854f86f0b.
SCTPhantom stems from a mismatch between two identities used during ASCONF chunk processing: the IPv4 packet source address (S) used for the DEL-IP validation check, and the Address Parameter (L) used to select the actual transport.
SCTPhantom Linux Kernel Flaw
Because Linux validates against S but later operates on the transport selected via L, an attacker can craft an ordered sequence [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] that removes a live transport while the association’s primary_path and active_path pointers still reference it.
This leaves a dangling pointer that a later socket operation dereferences, triggering a classic use-after-free. The flaw traces back to a 2007 commit (Linux 2.6.25) that completed the vulnerable wildcard-handling logic, meaning the bug persisted undetected for nearly two decades.
Security firm Corvus AI (developed jointly with TencentOS Security Team / Tencent Zhuque Lab) turned the initial finding into a full exploit chain using an automated, multi-agent vulnerability research pipeline.
The chain begins with a surviving SCTP transport UAF, achieved by carefully timing heartbeat states on a multihomed association, and proceeds through reclamation via pg_vec (TPACKET V1 ring buffers), which leaks a kernel direct-map address.
From there, a repeatable 4-byte kernel read primitive is built using SCTP_STATUS and sctp_assoc2id, and this read primitive is used to defeat KASLR through the CPU entry area’s IDT mapping.
A second UAF is then reclaimed with controlled SCTP authentication-key data to construct a fake kernel object graph, culminating in a data-oriented call to commit_creds() that yields global root without requiring shellcode or a ROP chain.
Tencent verified the escalation by checking /etc/shadow access and creating root-owned files, confirming true privilege escalation rather than a cosmetic UID change. Notably, the exploit does not require CAP_NET_ADMIN, CAP_SYS_ADMIN, or modified sysctls.
By enabling SCTP_ASCONF_SUPPORTED and SCTP_AUTH_SUPPORTED per-socket and including a valid AUTH chunk, an attacker inside a default-seccomp container can trigger the same shared-kernel UAF and pivot to call_usermodehelper_exec(), executing operations in the host’s initial namespaces.
In testing, six of eight container-escape attempts reached the host root, with the remaining two failing cleanly as pointer-walk misses rather than kernel panics.
Affected Systems
The vulnerability was validated against Ubuntu 24.04, Debian 13, Rocky Linux/RHEL 9, an OpenCloudOS-family build, and a mainline research kernel, all of which resulted in successful root access.
Fixes are available in kernel branches 6.6.148, 6.12.101, 6.18.42, 7.1.6, and mainline 7.2-rc5, with the upstream patch rejecting deletion of any transport still retained for the ASCONF chunk.
Administrators should apply the relevant stable kernel patches immediately, particularly on multi-tenant and container-hosting infrastructure where SCTP is enabled.
Since a kernel version string alone doesn’t guarantee patch status on vendor kernels, checking vendor advisories directly is essential before assuming exposure is resolved.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
