An 18-year-old vulnerability in the Linux kernel has been made public, which could enable a local attacker to obtain root privileges and, under certain conditions, escape from a container to the host system.
The flaw, referred to as SCTPhantom and listed as CVE-2026-64564, was discovered by researchers at Tencent’s Zhuque Lab in the Linux version of the Stream Control Transmission Protocol (SCTP).
In particular, it affects SCTP Dynamic Address Reconfiguration, leading to a use-after-free condition in the kernel. Tencent states that the flawed sequence has been around since Linux 2.6.25, which dates from 2007 or 2008.
The researchers were able to obtain root access on a number of different distributions and kernel versions, such as Debian 13 using Linux 6.12.95, Ubuntu 24.04 together with Linux 6.8.0-134, Rocky Linux 9/RHEL 9 using their vendor’s Linux 5.14 kernel, an OpenCloudOS-family system based on Linux 6.6.119, and a research system running Linux 7.2-rc2.
Regarding containerized environments, Tencent also demonstrated how to escape from a container to the host system using the same vulnerability.
The container test, which used the default seccomp profile, granted neither CAP_NET_ADMIN nor CAP_SYS_ADMIN to the container. In eight attempts, six succeeded in reaching root on the host system, while the other two failed during pointer traversal and did not cause a kernel panic.
It doesn’t follow that all Linux containers are automatically susceptible to escape. Tencent points out that actual exposure will depend on several factors, including the availability of SCTP, access to raw and packet sockets, the user namespace policy, the seccomp configuration, the Linux capabilities, and the Linux Security Module policies.
The researchers assigned SCTPhantom a base score of 8.5 out of 10 on the CVSS 4.0 scale, placing it in the High severity category. Local access and low privileges are required for exploitation, but user interaction is not necessary.
The fix to the Linux kernel upstream is much smaller in scale compared to the complexity of the resulting exploit; it prevents the DEL-IP processing from deleting the SCTP transport currently retained for the ASCONF chunk, thus removing the dangling-pointer condition.
For the affected stable branches, the earliest fixed kernel versions are Linux 6.6.148, 6.12.101, 6.18.42, and 7.1.6, whereas the fix appeared in the mainline version Linux 7.2-rc5. It is of course possible for vendors to apply the patch to their kernels without switching to any of these exact upstream versions, so it is still important to check the security advisory issued by the distribution.
The vulnerability CVE-2026-64564 has already been dealt with in Debian 13 “Trixie” via the 6.12.101-1 security kernel, and Debian’s security tracker shows that Debian 12 “Bookworm” together with Linux 6.1.180-1 and Debian 11 “Bullseye” together with Linux 5.10.262-1 are still vulnerable, whereas Forky and Sid are listed as being fixed.
Users and administrators running Linux kernels that may be affected should install the security updates provided by their Linux distribution rather than relying solely on the kernel version number.
