CVE-2026-64564: SCTP Flaw Enables Container Escape

TL;DR

A Linux kernel use-after-free in SCTP, tracked as CVE-2026-64564, allows local attackers to gain root. Researchers demonstrated privilege escalation and container-to-host escape on five distributions. The flaw is fixed upstream, and no exploitation in the wild has been confirmed.

Why CVE-2026-64564 Matters

This bug breaks a core container security boundary. An attacker inside a container can reach the shared host kernel. As a result, they can run code in the host’s initial namespaces and act as host root.

The tested exploit needed no special privileges. It kept the default seccomp profile active. Furthermore, it required neither CAP_NET_ADMIN nor CAP_SYS_ADMIN. Corvus AI, built by Tencent Zhuque Lab, reached host root in six of eight attempts.

How the Attack Works

The vulnerability lives in SCTP Dynamic Address Reconfiguration. SCTP supports multihoming, so one association can hold several peer transports. The kernel caches pointers to these transports for fast path lookups.

The problem is an identity mismatch. A DEL-IP check validates the request against the packet source address. However, later processing trusts a different transport chosen through the ASCONF Address Parameter.

Because these two values differ, a crafted ASCONF sequence removes one transport yet reuses its stale pointer. Consequently, the association keeps a dangling reference in its primary and active path. A later socket call then dereferences freed memory. Researchers chained this use-after-free into a kernel read primitive, KASLR recovery, and a data-oriented commit_creds() call for global root.

Affected Versions

The vulnerable code dates back to Linux 2.6.25. Therefore, the flaw affects a wide range of kernels and vendor builds. The team confirmed root on the following targets.

Confirmed Targets

• Ubuntu 24.04 (6.8.0-134-generic)
• Debian 13 (6.12.95)
• Rocky Linux 9 / RHEL 9 (5.14 vendor kernel, SCTP module loaded)
• OpenCloudOS-family (6.6.119)
• Research kernel Linux 7.2-rc2

A version string alone does not prove exposure. Vendors may backport the fix onto older bases, so check the vendor advisory instead.

Patch and Mitigation

The upstream fix rejects deletion of the transport retained for the ASCONF chunk. It mirrors the existing source-address guard. The mainline commit is 9b2854f86f0b, and it changes net/sctp/sm_make_chunk.c.

First Fixed Versions

• 6.6.y: 6.6.148
• 6.12.y: 6.12.101
• 6.18.y: 6.18.42
• 7.1.y: 7.1.6
• Mainline: 7.2-rc5

Admins should update promptly. If patching must wait, blocking the SCTP module reduces the attack surface where the protocol is unused. The vulnerability carries a CVSS v4.0 base score of 8.5 (High).

The finding comes from research by Corvus AI, an automated vulnerability pipeline from the TencentOS Security Team. You can read the full SCTPhantom technical write-up on Tencent’s research blog for the complete exploit chain. The Linux kernel CVE announcement and the upstream commit log confirm the patch details.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.