Key Takeaways
- CVE‑2026-64564, nicknamed SCTPhantom, is a use‑after‑free flaw in the Linux kernel’s Stream Control Transmission Protocol (SCTP) implementation that has existed since Linux 2.6.25 (≈ 2008).
- The bug stems from an address‑confusion error when processing ASCONF messages, allowing an attacker to free a transport object while a stale pointer remains cached.
- Tencent’s Zhuque Lab turned the memory‑corruption into a reliable local privilege‑escalation exploit, achieving root on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9‑family, OpenCloudOS and a Linux 7.2‑rc research kernel.
- The exploit also demonstrated a container‑to‑host escape without requiring privileged capabilities (CAP_SYS_ADMIN or CAP_NET_ADMIN) by leveraging per‑socket SCTP options and the
call_usermodehelper_exec()helper. - Patches have been backported to all maintained stable branches; the upstream fix is commit 9b2854f86f0b, first appearing in Linux 6.6.148, 6.12.101, 6.18.42, 7.1.6 and 7.2‑rc5.
- CVSS scores differ: a local‑attack vector yields CVSS 4.0 8.5 (High), while a network‑attack interpretation gives CVSS 3.1 9.8 (Critical). No public evidence of wild exploitation exists as of August 2026.
- Mitigation: install the vendor‑supplied patched kernel and reboot; if SCTP is unnecessary, prevent the module from loading; container hosts should review socket access, seccomp profiles and LSM policies.
- The vulnerability was uncovered with the aid of Corvus AI, a multi‑agent research pipeline that assisted from initial detection to a full root and container‑escape chain, highlighting the risk lurking in long‑lived, complex kernel subsystems.
Vulnerability Overview and Discovery Timeline
SCTPhantom (CVE‑2026-64564) is a use‑after‑free defect in the Linux kernel’s handling of SCTP ASCONF (Address Configuration) messages. The flaw resides in the code that manages dynamic addition or removal of IP addresses for an SCTP association. Researchers at Tencent’s Zhuque Lab identified the issue on 12 July 2026, privately reported it the same day, and built a working root exploit by 15 July. They refined the exploit across multiple kernel families between 15 – 23 July and validated a container‑to‑host escape on 27 July. The Linux CVE team published the official record on 4 August 2026, and public disclosure followed on 6 August 2026 after coordinated remediation.
Root Cause: Address Confusion Leading to a Dangling Pointer
The vulnerability arises because the kernel can evaluate two different addresses while processing a single ASCONF packet: the packet’s source address and an address embedded inside the ASCONF message used to select a transport object (asconf->transport). When handling a DELETE‑IP request, the safety check compares the deletion target with the packet’s source address, not with the cached transport pointer. By crafting an ASCONF message containing [Address Parameter L] [DEL‑IP L] [DEL‑IP 0.0.0.0] where L differs from the source address, the deletion of L passes the source‑address check, frees the associated sctp_transport, yet leaves asconf->transport pointing to the now‑free object. The subsequent wildcard deletion (0.0.0.0) reuses that stale pointer, installing the freed transport as the association’s primary/active path—a classic use‑after‑free condition.
From Memory Corruption to Arbitrary Read and KASLR Bypass
Tencent’s exploit first reclaimed the freed sctp_transport memory with a pg_vec array tied to a TPACKET transmit ring. When the kernel later processed an SCTP status request, it interpreted attacker‑controlled page pointers as legitimate transport fields, leaking a kernel direct‑map address that was also mapped into the attacker’s process. This disclosed a kernel address, enabling a repeatable four‑byte arbitrary‑read primitive. Using this primitive, the researchers read the Interrupt Descriptor Table (IDT) to recover the kernel’s KASLR offset, thereby calculating the runtime addresses of security‑sensitive functions such as commit_creds().
Achieving Root Privileges
With KASLR defeated, the exploit built a second controlled object graph in place of another released transport. By hijacking an SCTP address‑family callback, the chain redirected execution to commit_creds(), which replaced the process’s credentials with those of root. Tencent verified root access by reading /etc/shadow and creating a file owned by root under /root, providing concrete evidence beyond a mere UID change. Notably, the exploit avoided injecting traditional shellcode or constructing a ROP chain; it repurposed existing kernel functions and manipulated kernel objects to achieve privilege escalation.
Container‑to‑Host Escape Mechanism
Containers share the host kernel, so a kernel vulnerability can facilitate escape without breaching a hypervisor. Initially, Tencent thought the exploit required enabling the sysctls net.sctp.addip_enable and net.sctp.addip_noauth_enable, which demand CAP_NET_ADMIN. However, they discovered that an application could request the necessary SCTP functionality per‑socket via SCTP_ASCONF_SUPPORTED and SCTP_AUTH_SUPPORTED options, allowing a valid SCTP authentication chunk without modifying global settings. In their test container—running with the default seccomp profile and lacking CAP_NET_ADMIN or CAP_SYS_ADMIN—the researchers redirected execution to call_usermodehelper_exec() instead of commit_creds(). This helper runs in the host’s initial namespaces, permitting a root‑level filesystem operation outside the container. Six of eight escape attempts succeeded; the two failures resulted in clean pointer‑walk misses without crashing the kernel.
Scope Across Distributions and Kernel Versions
Root access was demonstrated on:
- Debian 13 (kernel 6.12.95+deb13-amd64)
- Ubuntu 24.04 (kernel 6.8.0-134-generic)
- Rocky Linux 9 and RHEL 9‑family systems using a vendor 5.14 kernel with SCTP loaded
- An OpenCloudOS‑family system (kernel 6.6.119)
- A Linux 7.2‑rc2 research kernel
These results confirm that the flaw resides in the common upstream SCTP implementation inherited by many distributions. However, exploit reliability can vary due to differences in structure sizes, allocator behavior, hardening options, and distribution‑specific patches, necessitating adaptation for certain builds.
Severity Scoring and Attack Context
Tencent assigned a CVSS 4.0 score of 8.5 (High) based on a local, low‑privilege attack requiring no user interaction, with full impact on confidentiality, integrity, and availability within the kernel. The CVE record later received a CVSS 3.1 score of 9.8 (Critical) under a network‑attack interpretation, assuming an attacker could deliver the malicious ASCONF sequence over the network. The disparity highlights that while the vulnerable code processes inbound SCTP packets, the full privilege‑escalation chain demonstrated by Tencent is locally initiated; remote exploitation would require additional conditions such as SCTP accessibility, association establishment, and dynamic‑address support. As of 8 August 2026, no public evidence of real‑world exploitation exists, and the vulnerability is absent from CISA’s Known Exploited Vulnerabilities catalog.
Mitigation and Organizational Response
Administrators should apply the corrected kernel packages supplied by their Linux distribution and reboot systems to ensure the patched kernel runs. Simply installing the package without a reboot leaves the vulnerable version in memory. Where SCTP is not required, blocking the module from loading reduces the attack surface, though this must be tested in environments that rely on SCTP for telecommunications, signalling, or high‑availability workloads. Container operators must audit whether workloads can create SCTP, raw, or packet sockets, verify that seccomp profiles block unnecessary socket families and operations, and review Linux Security Module (LSM) policies—not assuming that dropping broad capabilities alone eliminates exposure. Security teams should confirm remediation by checking distribution advisories or verifying that the vendor kernel includes the backported commit (9b2854f86f0b); relying solely on uname -r output can be misleading due to downstream backporting practices.
Role of AI‑Assisted Research in the Discovery
Tencent credited the discovery and exploit development to Corvus AI, a multi‑agent vulnerability‑research pipeline built by the TencentOS Security Team and Zhuque Lab. Corvus AI divided the research into bounded tasks—source review, packet generation, VM testing, crash triage, and exploit development—while preserving evidence and constraints across experiments. This enabled different agents and models to build upon prior findings, progressing the issue from an initial soft lockup to a reproducible post‑RCU use‑after‑free, a cross‑distribution root exploit, and finally a container‑to‑host escape. The case underscores that obscure, mature kernel subsystems can harbor exploitable bugs for years, and that increasingly sophisticated machine‑assisted analysis can uncover complex lifetime mismatches that elude traditional review.
Conclusion
SCTPhantom exemplifies how a seemingly innocuous protocol feature—dynamic address reconfiguration in SCTP—can conceal a critical use‑after‑free vulnerability persisting for nearly two decades. The flaw enables local privilege escalation and, under realistic container configurations, a host‑level escape without privileged capabilities. Prompt patching, careful module management, and rigorous container hardening are essential to mitigate risk. The discovery also highlights the value of advanced AI‑driven research initiatives in uncovering deep‑seated kernel bugs before they are weaponized in the wild.