CVE-2026-64564 SCTPhantom: 18-year Linux kernel SCTP UAF with local privilege escalation and container-escape risk
Tencent Zhuque Lab's Corvus AI found CVE-2026-64564, a UAF in Linux kernel SCTP ASCONF handling present since 2.6.25. A local attacker can escalate to root and escape to the host under default container configs. The patch landed in mainline as 9b2854f.
On 6 August 2026, Tencent Zhuque Lab and the TencentOS security team published a technical analysis of CVE-2026-64564 (SCTPhantom), a high-severity local privilege-escalation bug in the Linux kernel SCTP stack. The flaw sits in SCTP dynamic address reconfiguration (RFC 5061): `sctp_process_asconf_param()` does not validate `asconf->transport` when handling an ASCONF DEL-IP parameter, so a later wildcard path reuses a dangling pointer and triggers a use-after-free (UAF). Present since Linux kernel v2.6.25 — 18 years — it hits 6.x mainline plus Debian, Ubuntu, and TencentOS Server LTS branches.
Incident overview
Corvus AI, TencentOS security's multi-agent vuln research pipeline, first found the bug during a structured analysis of the SCTP stack. Researchers then produced a stable local privilege-escalation and container-to-host escape chain on Debian 13, Ubuntu 24.04, Rocky Linux 9, OpenCloudOS, and TencentOS Server. Upstream closed the identity-mismatch defect with a 6-line fix (commit `9b2854f86f0b`). Fixed versions: 6.6.148, 6.12.101, 6.18.42, 7.1.6, and mainline 7.2-rc5. Security patches are also out for TencentOS Server 2.4, 3.1, 3.2, 3.3, 4.4, and 4.5.
Technical details
SCTP represents an association as `struct sctp_association`. The `peer.transport_addr_list` linked list holds multi-homed path objects (`struct sctp_transport`); `peer.primary_path` and `peer.active_path` cache pointers into that list. After RFC 5061 added ASCONF dynamic address reconfiguration, `sctp_process_asconf()` walks the chunk in packet order, parsing Address Parameter plus ADD-IP / DEL-IP / SET-PRIMARY ops.
Root cause: DEL-IP validity is checked only against the packet IPv4 source address S, but later transport reuse is keyed off Address Parameter L. When S and L differ, an attacker can pack one ASCONF chunk as:
- [Address Parameter L][DEL-IP L]: S ≠ L, so the DEL-IP check passes and the transport pointed to by `asconf->transport` is freed.
- [DEL-IP 0.0.0.0]: wildcard paths `sctp_assoc_del_nonprimary_peers()` and `sctp_assoc_set_primary()` reuse that dangling pointer.
- Later socket ops: kernel UAF, which can panic, leak, or escalate privileges.
Corvus AI built this full chain: SCTP transport UAF → realloc page vec to leak kernel direct-map pages → repeated 4-byte kernel reads → recover KASLR via IDT → second UAF occupied by SCTP authentication-key data to form a controllable kernel object graph → data-oriented call to `commit_creds()` → global root → usermode-helper variant escapes to the host. Escape still works under the default seccomp profile without granting the container `CAP_NET_ADMIN` or `CAP_SYS_ADMIN`.
Impact
Affects nearly every kernel from Linux 2.6.25 through current 6.x mainline. Vendor kernels include TencentOS Server 2.4 / 3.1 / 3.2 / 3.3 / 4.4 / 4.5, Debian 11 / 12 / 13 / 14, and Ubuntu 24.04 LTS. Exploit needs local access and a loaded SCTP module — conditions containers, Kubernetes pods, CI workers, and jump hosts typically meet. Compromise yields root and host escape via the shared kernel. Combined with common enterprise defaults (SCTP loadable in pods, packet sockets unrestricted), overall risk is high.
Remediation
- Kernel upgrade: move to upstream 6.6.148 / 6.12.101 / 6.18.42 / 7.1.6 / mainline 7.2-rc5, or the matching vendor backport. TencentOS Server users: `yum update kernel -y && reboot`, then confirm with `uname -r`.
- Temporary mitigation: if SCTP can be disabled, run `sh -c "printf 'install sctp /bin/false\n' > /etc/modprobe.d/block-CVE-2026-64564.conf; rmmod sctp 2>/dev/null; true"` to block module load. `lsmod | grep sctp` should be empty.
- Container hardening: use seccomp/AppArmor to restrict `AF_SCTP` and `CAP_NET_*`; block unrelated containers from loading SCTP and packet sockets; reassess pods with `network_mode: host`.
- Incident response: hunt container-host logs since 23 July 2026 (upstream patch merge) for `sctp_process_asconf` panics and anomalous socket calls.
References
- Tencent Security / Corvus AI: SCTPhantom, an 18-year Linux kernel privilege-escalation and container-escape vulnerability
- Tencent Zhuque Lab: SCTPhantom technical analysis
- Tencent Cloud security advisory: Linux Kernel SCTP SCTPhantom local privilege escalation
- Linux upstream patch commit 9b2854f86f0b
- NVD CVE-2026-64564