Loading story…
A long-standing Linux kernel flaw in SCTP Dynamic Address Reconfiguration, tracked as CVE-2026-64564 and dubbed SCTPhantom, was disclosed as a deterministic use-after-free bug that can let a low-privileged local user gain root privileges and potentially escape from a container to the host. The vulnerability affects ASCONF handling, where a crafted sequence of DEL-IP operations can free an SCTP transport and later reuse the dangling pointer. Researchers said the vulnerable logic dates back to Linux 2.6.25 and reported successful exploitation on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9-family systems, OpenCloudOS, and a Linux 7.2 release candidate, including multiple tested host-root container escapes.
Fixes are available in mainline commit 9b2854f86f0b and in stable kernel releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. Discussion on the oss-sec mailing list noted that practical exposure varies by distribution: on Rocky Linux 9 and RHEL 9-family systems, SCTP is typically not installed by default because it resides in the kernel-modules-extra package and is blacklisted for autoload, meaning administrators would generally need to explicitly install and load the module for the bug to be reachable. Defenders were urged to patch affected kernels or disable SCTP where it is not required.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Solar Designer replied that on Rocky Linux 9 and RHEL 9-family systems, SCTP is typically not installed by default because it resides in kernel-modules-extra and is blacklisted for autoload. He said exploitation on those systems generally requires an administrator to explicitly install and load SCTP, limiting practical exposure mainly to systems intentionally using it.
In an oss-sec reply, Emily Shepherd noted the write-up lacked a mitigation section and asked whether unloading or blacklisting the SCTP kernel module would protect systems where SCTP is not built in. The message did not provide a confirmed answer.
Fourie Zhang of the TencentOS Security Team and Tencent Zhuque Lab publicly disclosed CVE-2026-64564 on the oss-sec mailing list, describing local root escalation and container escape impact. The disclosure included technical details, affected fixed versions, and validation across Debian 13, Ubuntu 24.04, Rocky Linux 9/RHEL 9-family systems, and a 7.2-rc2 research kernel.
The Linux kernel CVE team assigned the identifier CVE-2026-64564 two days before the public disclosure. The issue covers a use-after-free in Linux SCTP Dynamic Address Reconfiguration.
Linux stable kernel releases 6.6.148, 6.12.101, 6.18.42, and 7.1.6 were released with fixes for the SCTPhantom vulnerability. The mainline fix is identified as commit 9b2854f86f0b, and 7.2-rc5 is also listed as fixed.
Private disclosure of the Linux SCTP use-after-free vulnerability later tracked as CVE-2026-64564 began on July 12, 2026. This predates the CVE assignment and subsequent public disclosure of SCTPhantom.
The SCTP ASCONF transport handling flaw later tracked as CVE-2026-64564 dates back to Linux 2.6.25. The disclosure ties the vulnerable sequence to commit 42e30bf3463c in 2008.
A public exploit for CVE-2026-64564 became available, demonstrating container escape and host-root compromise from an unprivileged container under certain conditions. The write-up says the exploit chain abuses the SCTP use-after-free, leaks a kernel address, and launches a process in the host namespaces outside the container boundary.
Jun Yang authored, and Jakub Kicinski committed, upstream Linux kernel commit 9b2854f86f0b to block DEL-IP from deleting the transport currently referenced by ASCONF processing, fixing the SCTP use-after-free later tracked as CVE-2026-64564. The patch was also copied to stable@kernel.org for backporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
18 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcelinuxsecurity.com
Open sourceopennet.ru
Open sourceopennet.me
Open sourcelore.kernel.org
Open sourcegit.kernel.org
Open sourcegit.kernel.org
Open sourcegit.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
STAR Labs publicly disclosed **CVE-2026-53264**, a Linux kernel local privilege escalation flaw in the `net/sched` traffic-control subsystem, and released exploit details showing how an unprivileged local user can obtain root access under specific conditions. The bug stems from a use-after-free race in `tcf_idr_check_alloc()`, where action objects can be freed during lookup because of a lock and RCU mismatch. The researcher demonstrated reliable exploitation on CentOS Stream 9 by racing `RTM_NEWTFILTER` and `RTM_DELTFILTER`, reclaiming freed `tc_action` objects, and ultimately overwriting `core_pattern` to execute code as root. The write-up said exploitation depends on factors including enabled unprivileged user namespaces and relevant `net/sched` components such as `clsact` and `flower`, with additional techniques used to improve reliability, including an `EntryBleed` kASLR leak and race optimization with `timerfd` and `epoll`. Researcher Lee Jia Jie said AI helped identify the bug, generate a KASAN proof of concept, and refine exploit reliability, although human validation remained essential. The upstream patch landed on June 1 and was backported to several stable branches, but distribution-level patch coverage was still uneven, and no confirmed in-the-wild exploitation had been reported.
Aug 11, 2026
Two Linux kernel vulnerabilities, **CVE-2026-53362** and **CVE-2026-53366**, were disclosed in the UDP packet handling path and can allow a local unprivileged user to escalate privileges to root. The flaws affect the IPv6 UDPv6 path and the IPv4 UDP path when `MSG_SPLICE_PAGES` is used with UDP corking and a datagram crosses a fragment boundary, causing a heap out-of-bounds write. Researchers said incorrect `fraggap` accounting lets validation be bypassed, leading to corruption of `skb_shared_info` metadata and manipulation of the `nr_frags` field, which can ultimately produce a use-after-free condition exploitable for local privilege escalation. The bugs affect Linux kernels from **v6.1 onward**. The IPv6 issue requires `CONFIG_IPV6=y`, while the IPv4 variant also depends on access conditions tied to user namespaces. Fixes were published in upstream commits `736b380e28d0` for IPv6 and `eca856950f7c` for IPv4, and were released in stable kernel versions including **7.1.3, 6.18.38, 6.12.95, 6.6.144, and 6.1.177**. Advisories or updates were issued by major distributions including **Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, and Fedora**.
Jul 23, 2026
A critical vulnerability tracked as **`CVE-2026-15422`** was disclosed in the illumos SCTP stack, where improper validation of `INIT ACK` chunk address parameters can let a remote, unauthenticated attacker trigger kernel heap corruption and potentially achieve remote code execution. The flaw affects the SCTP inbound path because association lookup for `INIT ACK` traffic occurs before SCTP integrity checks and before IPsec policy is applied, expanding exposure for systems that process crafted network packets. The issue has reportedly existed since a 2010 `illumos-gate` commit and impacts illumos-based platforms including downstream distributions such as **SmartOS**.
Jul 17, 2026