18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
A use-after-free bug in Linux's SCTP networking code can be turned into full root on a host, and Tencent researchers say they used it to escape a container and reach the machine underneath. The flaw has existed since 2008.
Intelligence analysis by Llama
A 18-year-old Linux SCTP flaw can be turned into full root on a host, allowing local users to escape containers and reach the machine underneath. The flaw has existed since 2008 and has been patched in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148.
Imagine you're playing a game where you can move around on a map. But, someone has found a way to make the game think you're somewhere you're not. They can then do things that you can't do, like move to a place you can't go. This is kind of like what's happening with the Linux SCTP flaw. Someone has found a way to make the game (or in this case, the computer) think they're somewhere they're not, and they can do things that they shouldn't be able to do.
Analysis
Background
The flaw, tracked as CVE-2026-64564 and named SCTPhantom by its finders, is a use-after-free bug in Linux's SCTP networking code. It has existed since 2008 and has been in every kernel released since Linux 2.6.25.
What Changed
Tencent researchers say they used the flaw to escape a container and reach the machine underneath. They claim to have gotten root on the kernel builds they tested for Debian 13, Ubuntu 24.04, Rocky Linux 9, and RHEL 9.
What's Next
The fix already shipped: stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148, released August 3, close the flaw. Anyone running an older kernel with SCTP reachable should update. Tracked as CVE-2026-64564 and named SCTPhantom by its finders, the flaw was disclosed publicly on August 6, two days after the kernel CVE team assigned it.
Key points
- A 18-year-old Linux SCTP flaw can be turned into full root on a host, allowing local users to escape containers and reach the machine underneath.
- The flaw has existed since 2008 and has been patched in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148.
- Tencent researchers claim to have gotten root on the kernel builds they tested for Debian 13, Ubuntu 24.04, Rocky Linux 9, and RHEL 9.
- The fix already shipped: stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148, released August 3, close the flaw.
If this development plays out positively, it could lead to better security measures being put in place to prevent similar flaws from being exploited in the future.
The realistic downside risks or failure modes of this development include the potential for malicious actors to exploit the flaw and gain unauthorized access to systems, leading to data breaches and other security incidents.
