Every few years, the Linux kernel community confronts a vulnerability so old that it predates entire generations of cloud infrastructure. CVE-2026-64564 — nicknamed SCTPhantom — is one of those flaws. Buried inside the kernel’s SCTP networking stack since 2008, this use-after-free bug allows a low-privileged local user to escalate to root and, in many cases, escape from a container straight onto the host. In this post, we will unpack how the bug works, why it stayed hidden for nearly two decades, and exactly what you need to do to protect your systems.

Table of Contents

1. What Is SCTP and Why Should You Care?
2. How SCTPhantom Was Discovered
3. The Technical Breakdown: A Use-After-Free in ASCONF
4. The Attack Chain: From Low Privilege to Root
5. Container Escape: Crossing the Boundary
6. Affected Distributions and Kernel Versions
7. How to Check If Your System Is Vulnerable
8. Immediate Mitigations
9. Patching Your Systems
10. Lessons for the Future
11. Conclusion

What Is SCTP and Why Should You Care?

SCTP stands for Stream Control Transmission Protocol. The IETF designed it in the early 2000s as a robust alternative to TCP. Unlike TCP, SCTP supports multihoming — one association can span multiple IP addresses and network paths simultaneously. This makes SCTP popular in telecom signaling (SIGTRAN), WebRTC data channels, and certain high-availability clustering setups.

A companion feature called Dynamic Address Reconfiguration (defined in RFC 5061) lets a peer add or remove addresses from an active association without tearing it down. The kernel implements this through ASCONF chunks — special SCTP messages that carry address-management commands like ADD-IP and DEL-IP.

Here is the catch: most Linux servers do not actively use SCTP. Yet the kernel module often sits loaded and ready, especially on distributions that ship it as part of the base kernel or the kernel-modules-extra package. An attacker does not need your server to run an SCTP application. They only need the module present and reachable.

How SCTPhantom Was Discovered

Researchers at Tencent Zhuque Lab uncovered this flaw using Corvus AI, a multi-agent vulnerability research pipeline they built specifically for kernel auditing. Traditional static analyzers often miss bugs that span complex state machines — like the one inside SCTP’s ASCONF handler. Corvus AI navigates the kernel tree, iterates on proof-of-concept code, builds and boots test kernels, collects sanitizer reports, and uses those results to guide the next experiment.

The team named the bug SCTPhantom because the exploit manipulates phantom transport pointers — references to memory that the kernel has already freed but still trusts. Tencent published a detailed technical write-up on August 6, 2026, two days after the Linux kernel CVE team assigned the identifier CVE-2026-64564.

The Technical Breakdown: A Use-After-Free in ASCONF

The vulnerability lives in sctp_process_asconf(), a function inside net/sctp/sm_make_chunk.c. When the kernel receives an ASCONF chunk, it caches the transport pointer in asconf->transport. That pointer corresponds to the address listed in the ASCONF’s Address Parameter — not necessarily the packet’s actual source address.

The kernel already rejects a DEL-IP command that targets the packet’s source address (the so-called ADDIP D8 check, returning SCTP_ERROR_DEL_SRC_IP). However, it does not protect the cached asconf->transport pointer itself. This gap creates a window where an attacker can trick the kernel into freeing a transport that it still plans to use.

The Malicious ASCONF Sequence

An attacker crafts a single ASCONF chunk with three ordered parameters:

1. Address Parameter L — points to a non-source address.
2. DEL-IP L — removes that address. This passes the D8 check because L is not the source address. The kernel calls sctp_assoc_rm_peer(), which frees the transport that asconf->transport still references.
3. DEL-IP 0.0.0.0 — a wildcard delete. The kernel now reuses the dangling asconf->transport pointer inside sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers().

The result? The kernel dereferences freed memory, corrupts the association’s primary_path and active_path, and leaves the transport count at zero while still holding stale pointers. This is a textbook use-after-free (CWE-416) with kernel-level consequences.

The Attack Chain: From Low Privilege to Root

Tencent’s proof-of-concept demonstrates a reliable local privilege escalation. The trigger is deterministic, requires only low local privileges, and needs no user interaction. The CVSS v4.0 base score sits at 8.5 (High) with the vector:

plain

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

In plain terms: a local, low-privileged attacker can achieve complete confidentiality, integrity, and availability impact on the host.

The exploit leverages the use-after-free to gain control over kernel memory. From there, the attacker can overwrite credential structures, elevate their process to root, and execute arbitrary code in kernel context. The researchers tested this successfully on multiple kernel builds across major distributions.

Container Escape: Crossing the Boundary

Perhaps the most alarming aspect of SCTPhantom is its ability to break container isolation. In modern cloud environments, containers rely on the kernel to enforce boundaries. If an attacker can execute code in kernel mode, those boundaries vanish.

Tencent demonstrated container-to-host escape on standard configurations. Their tests used the default seccomp profile and granted neither CAP_NET_ADMIN nor CAP_SYS_ADMIN to the container. In six out of eight attempts, the exploit reached root on the host.

Early attempts required enabling net.sctp.addip_enable and net.sctp.addip_noauth_enable through sysctls — which normally demands CAP_NET_ADMIN. The researchers later refined their approach to enable these features per-socket instead, removing that barrier entirely.

This means that even a properly locked-down container — running with minimal capabilities and standard Docker or Kubernetes defaults — remains at risk if the host kernel is unpatched and the SCTP module is available.

---

Affected Distributions and Kernel Versions

The vulnerable code entered the kernel with commit 42e30bf3463c in Linux 2.6.25, released in 2008. Every kernel since then carried the flaw until the fix landed in early August 2026.

The Linux kernel team released patches for the following stable branches:

Table

Kernel Branch	First Fixed Version
6.6 LTS	6.6.148
6.12 LTS	6.12.101
6.18	6.18.42
7.1	7.1.6
7.2-rc	7.2-rc5

Tencent validated successful exploitation on:

• Debian 13 (kernel 6.12.95+deb13-amd64)
• Ubuntu 24.04 (kernel 6.8.0-134-generic)
• Rocky Linux 9 / RHEL 9 (vendor 5.14 kernel with SCTP loaded)
• OpenCloudOS
• Linux 7.2-rc2 (research kernel)

On RHEL-family systems, the SCTP module typically lives inside the optional kernel-modules-extra package, which is not installed by default. Even when installed, that package includes blacklist rules that prevent unprivileged autoloading. A sysadmin must explicitly load the module for the vulnerability to become reachable.

How to Check If Your System Is Vulnerable

Before you panic, verify whether your system actually exposes the attack surface. Run these commands on any Linux host you manage.

Step 1: Check if the SCTP Module Is Loaded

bash

lsmod | grep sctp

If you see output like this, the module is active:

plain

sctp                 425984  4
sctp_diag            16384  0

Step 2: Check if SCTP Is Blacklisted

bash

cat /etc/modprobe.d/* | grep -i sctp

Look for lines like:

plain

blacklist sctp
blacklist sctp_diag
install sctp /bin/false

If these exist, the module cannot load automatically — a strong defensive layer.

Step 3: Check Your Kernel Version

bash

uname -r

Compare your version against the fixed releases listed above. Anything older than the patched version is vulnerable if SCTP is reachable.

Step 4: Verify SCTP Socket Exposure

bash

ss -ano | grep sctp

If this returns listening or established SCTP sockets, your system actively uses the protocol and faces higher exposure.

Immediate Mitigations

If you cannot patch right away, take these steps to reduce risk.

Option 1: Disable and Blacklist the SCTP Module

If your environment does not need SCTP, disable it immediately.

Unload the module:

bash

sudo modprobe -r sctp
sudo modprobe -r sctp_diag

Create a blacklist file to prevent future loading:

bash

sudo tee /etc/modprobe.d/blacklist-sctp.conf << 'EOF'
blacklist sctp
blacklist sctp_diag
install sctp /bin/false
install sctp_diag /bin/false
EOF

Verify the block:

bash

sudo modprobe -n -v sctp

You should see:

plain

install /bin/false

If the module is currently in use and refuses to unload, schedule a reboot after applying the blacklist.

Option 2: Block SCTP Traffic at the Firewall

If you must keep the module loaded but do not need external SCTP traffic, drop it at the network edge:

bash

sudo iptables -A INPUT -p sctp -j DROP
sudo iptables -A OUTPUT -p sctp -j DROP
sudo ip6tables -A INPUT -p sctp -j DROP
sudo ip6tables -A OUTPUT -p sctp -j DROP

For nftables users:

bash

sudo nft add rule inet filter input sctp drop
sudo nft add rule inet filter output sctp drop

Option 3: Restrict Container Capabilities

If you run containers on unpatched hosts, drop all unnecessary capabilities and avoid granting CAP_NET_ADMIN or CAP_SYS_ADMIN. While Tencent’s final exploit bypassed the sysctl route, defense-in-depth still matters.

Example Docker run flags:

bash

docker run --cap-drop=ALL --cap-add=CHOWN --cap-add=SETUID \
  --security-opt=no-new-privileges:true your-image

Patching Your Systems

The definitive fix is a kernel upgrade. Most major distributions have already backported the patch or will do so within days of disclosure.

Ubuntu / Debian

bash

sudo apt update
sudo apt upgrade linux-image-generic
sudo reboot

RHEL / Rocky Linux / AlmaLinux

bash

sudo dnf update kernel
sudo reboot

Arch Linux

bash

sudo pacman -Syu linux
sudo reboot

Verify the Fix After Reboot

bash

uname -r

Confirm your kernel version matches or exceeds the fixed releases. Then confirm the patch commit is present:

bash

grep -r "sctp: don't free the ASCONF's own transport" /usr/src/linux-headers-$(uname -r)/net/sctp/ 2>/dev/null || echo "Headers not found; check with your package manager"

Lessons for the Future

SCTPhantom teaches us several hard lessons about kernel security.

First, protocol code is easy to overlook. SCTP is not glamorous. It does not dominate headlines like eBPF or io_uring. Yet it has lived in the kernel for two decades, and its state machine is complex enough to hide subtle pointer bugs. Security teams should audit not just the hot paths but also the quiet corners.

Second, AI-assisted vulnerability research is now a reality. Tencent’s Corvus AI did not just find the bug — it helped develop the proof of concept, cross-compile for multiple distributions, and validate the exploit chain. This means defenders must move faster, because attackers are already using similar tools.

Third, container isolation is not a magic shield. When the vulnerability sits in kernel space, every container on that host is only as secure as the kernel beneath it. Regular kernel patching remains non-negotiable, even in container-heavy environments.

Conclusion

CVE-2026-64564 is a sobering reminder that old code can carry fresh dangers. The bug hid inside the Linux kernel for eighteen years, through hundreds of releases, and only emerged when researchers paired human expertise with AI-driven analysis. If you manage Linux systems — whether bare metal, virtual machines, or containers — check your kernel version today. Patch if you can. Disable SCTP if you do not need it. And treat kernel updates as a critical part of your security rhythm, not an optional maintenance task.