A newly disclosed Linux security vulnerability has revealed that a flaw hidden in the operating system for nearly 18 years could allow local attackers to gain root-level access. The vulnerability, tracked as CVE-2026-64564 and named SCTPhantom, affects the Linux kernel’s Stream Control Transmission Protocol (SCTP). Security researchers from Tencent Zhuque Lab discovered the issue and demonstrated that it could also be used to escape from containers under certain conditions.
The vulnerability is a use-after-free memory bug that has existed since Linux kernel 2.6.25, released in 2008. It occurs because the kernel incorrectly handles certain SCTP address deletion requests, causing it to continue using memory that has already been released. This can result in memory corruption, opening a path for attackers to elevate their privileges and potentially take complete control of the affected system.
Researchers explained that the flaw is not remotely exploitable. An attacker must already have local access to the target machine, and the SCTP protocol must also be reachable on that system. Even with these limitations, successful exploitation can allow a local user to obtain root privileges. Tencent reported successful tests on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS using vulnerable kernel versions.
SCTP is a transport-layer protocol that supports multiple communication paths within a single connection and allows network addresses to be added or removed while the connection remains active. According to the researchers, the bug occurs because the Linux kernel validates one network address but performs deletion on another address contained in the same message. This mistake creates a dangling pointer that references memory that has already been freed, making exploitation possible.
Tencent researchers also demonstrated that the vulnerability could be used to escape from Linux containers and reach the underlying host operating system. During their testing, they achieved host root access in six out of eight attempts while using the default seccomp profile without requiring CAP_NET_ADMIN or CAP_SYS_ADMIN capabilities. However, these results have not yet been independently verified by other security researchers, and the container runtime used during testing has not been publicly identified.
The Linux kernel development team has already released security updates to fix the issue. The vulnerability has been patched in stable kernel versions 7.1.6, 6.18.42, 6.12.101, and 6.6.148, which became available on August 3, 2026. Security experts recommend that administrators update their systems as soon as possible because Linux distributors may backport the fix without changing the visible kernel version number. Users should therefore check their operating system vendor’s security advisories instead of relying only on kernel version strings.
At the time of disclosure, there was no public exploit code available for the vulnerability, and it had not been added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalog. The severity score also remains under review. Tencent assigned the flaw a CVSS v4.0 score of 8.5, while the U.S. National Vulnerability Database had not yet published its own severity rating or weakness classification.
Security professionals recommend applying the latest kernel updates immediately if SCTP is enabled on Linux systems. Organizations that do not require SCTP should consider disabling or blocking the protocol to reduce their attack surface. The discovery also highlights how advanced research methods, including Tencent’s AI-assisted Corvus AI platform, are helping uncover long-hidden vulnerabilities that have remained unnoticed in widely used open-source software for many years.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
