SCTPhantom CVE-2026-64564: patch your Linux kernel

CVE-2026-64564 — SCTPhantom — is a use-after-free in the Linux kernel's SCTP code that turns a local foothold into root, and in Tencent's testing, escapes a container onto the host underneath. It has been in the kernel since 2.6.25 shipped in 2008. Patched stable kernels landed August 3. If you run Linux servers or containers, update and reboot this week.

What actually happened

Tencent Zhuque Lab found the bug and disclosed it publicly on August 6. SCTP lets one connection run across several network paths; a companion feature, dynamic address reconfiguration, lets a peer add or drop those paths mid-connection. The flaw is an identity mismatch: per NVD, the kernel validates a DEL-IP request against the packet's source address but acts on a transport it selected from a different address inside the message. One crafted ASCONF message frees a path and then reuses the dangling pointer.

The specifics you need:

• Reachable from an unprivileged local user. Tencent reports root in 6 of 8 attempts without CAP_NET_ADMIN or CAP_SYS_ADMIN, on stock kernel builds for Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9 and OpenCloudOS.
• Fixed in stable kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148, released August 3. NVD also lists 7.2-rc5.
• Local, not remote, and it requires SCTP to be reachable — which is the mitigation hiding in plain sight.
• Tencent rates it CVSS 8.5 (v4.0). NVD had not published its own score at the time of writing, and it was not in CISA's KEV catalog as of August 7. No public exploit code yet.

Why a local kernel bug matters for your business

"Local only" reads like "not our problem" until you count how many things on your network already run untrusted code as an unprivileged user. Your CI runner executes pull requests. Your web app accepts uploads. Your AI coding agent runs commands in a sandbox that is a namespace, not a machine. Every one of those is a local user, and SCTPhantom promotes them to root on the host — which, on a container host, means every other tenant on the box.

Two actions, in order. Patch and reboot, then verify uname -r rather than trusting the package manager's word. Then turn SCTP off where you don't use it — and almost nobody uses it. Blacklisting the module removes the attack surface entirely and costs nothing, which makes it the better permanent control for hosts you can't reboot on demand.

The pattern is worth noting: this is the second kernel privilege-escalation bug this summer found by a lab pointing automated tooling at old code. Eighteen-year-old bugs are getting found faster than your quarterly patch cycle can absorb them.

Sources: The Hacker News, NVD.