A critical vulnerability in Linux’s SCTP networking code, existing since 2008, has been identified as a security risk allowing local users to gain root access and potentially escape containers. This flaw, tracked as CVE-2026-64564 and dubbed ‘SCTPhantom’ by its discoverers, was publicly disclosed on August 6, following its identification by Tencent researchers. While no public exploit has been reported, users are urged to update their systems to the latest stable kernels to mitigate the threat.
Details of the SCTP Flaw
The vulnerability arises from a use-after-free bug in the SCTP protocol’s handling of network paths. Specifically, the issue occurs when the kernel processes a delete request based on a packet’s source address but acts on a different address within the message. This flaw can be exploited to gain unauthorized root access. The issue is localized rather than remote, reducing its exposure, but it remains a significant risk for systems with SCTP enabled.
Stable kernel versions 7.1.6, 6.18.42, 6.12.101, and 6.6.148, released on August 3, have addressed this vulnerability. Users operating on older kernel versions are advised to update without delay. The flaw has been confirmed on various distributions including Debian 13, Ubuntu 24.04, Rocky Linux 9, and RHEL 9, where SCTP is accessible.
Impact and Mitigation
Tencent’s Zhuque Lab demonstrated the flaw’s potential by achieving root access on tested Linux builds. Their research outlined a method to exploit the bug without requiring elevated privileges typically associated with CAP_NET_ADMIN, thereby increasing the vulnerability’s significance. Although the lab’s findings have not been independently verified, the potential for container escape and unauthorized access underscores the need for immediate patching.
To prevent exploitation, users should ensure their systems are updated to the patched kernel versions. Disabling SCTP where it is not necessary can further reduce the attack surface. Security configurations such as seccomp profiles and user-namespace policies should be reviewed to mitigate potential risks.
Future Outlook
The discovery of SCTPhantom highlights the enduring challenge of latent vulnerabilities within widely-used software. As the Linux community continues to address these issues, machine-assisted research, like that employed by Tencent, plays a crucial role in identifying and patching dormant security flaws. Users are encouraged to stay informed about updates and to apply patches promptly to safeguard their systems.
With the recent patch release, and ongoing efforts by security researchers, the risk posed by the SCTP vulnerability can be effectively managed. However, vigilance and proactive system maintenance remain essential in protecting against similar threats in the future.
