Loading vulnerability…
SCTPhantom is a use-after-free vulnerability in the Linux kernel's SCTP Dynamic Address Reconfiguration handling, specifically ASCONF DEL-IP processing. In the vulnerable logic, sctp_process_asconf() caches the transport used to process an ASCONF chunk in asconf->transport. When an ASCONF is located via its Address Parameter rather than the packet source address, the cached transport can refer to a different peer transport than the source address being validated. A crafted ASCONF sequence can then delete the transport still referenced by asconf->transport through sctp_assoc_rm_peer(), after which subsequent wildcard DEL-IP handling reuses the dangling pointer in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(). This can dereference freed transport fields, store freed pointers into the association's primary_path and active_path, and corrupt SCTP association state. The vulnerable code lineage dates back to Linux 2.6.25.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
Repository is a small standalone local privilege escalation PoC for CVE-2026-64564 ("SCTPhantom"), containing one C source file, a README, and a license. The README states the exploit targets a Linux kernel SCTP ASCONF DEL-IP use-after-free caused by mismatched validation and object selection during address deletion, and that this copy is a mirror of an upstream community PoC. The code is tailored to Debian 13 running kernel 6.12.95, with hardcoded structure offsets verified against that build. The main exploit file, lpe_debian.6.12.95.c, is a native C program implementing a full local kernel exploitation chain rather than mere detection. It uses SCTP sockets on loopback addresses and crafted ASCONF/DEL-IP behavior to trigger a use-after-free in SCTP transport handling. It then performs heap shaping and reclamation using AF_PACKET PACKET_TX_RING allocations and SCTP authentication-key allocations to reclaim freed kernel objects with attacker-controlled data. The README indicates the chain includes direct-map leakage, repeated 4-byte kernel reads, KASLR recovery via fixed IDT mapping, a second UAF reclamation with controlled SCTP auth-key objects, and a data-only path to commit_creds() for privilege escalation. Notable exploit capabilities visible in the code and README include: enabling/disabling /proc/sys/net/sctp/auth_enable to facilitate spraying, creating AF_PACKET packet sockets with PACKET_TX_RING for controlled page-backed allocations, creating SCTP sockets and setting SCTP_AUTH_KEY options for kmalloc-1024 object spraying, checking for successful root by reading /etc/shadow, writing a success marker to /root/SCTP_LPE_SUCCESS, and optionally spawning /bin/sh. The exploit is operational but environment-specific: it depends on a vulnerable Linux kernel with SCTP support and likely requires adaptation for kernels other than Debian 13 6.12.95 due to hardcoded offsets.
This repository is a compact local privilege escalation proof-of-concept for Debian 13 on kernel 6.12.95 targeting an SCTP ASCONF DEL-IP use-after-free in the Linux kernel. The repository contains only a README with build/run instructions and a single substantial C source file implementing the exploit. The exploit is not a remote exploit in the usual sense; it is a local kernel exploit that abuses networking subsystems. Its core capability is to obtain root privileges from an unprivileged local context by corrupting kernel memory associated with SCTP transport/address-family structures. The code uses AF_PACKET PACKET_TX_RING allocations as a heap-spray/reclamation primitive and SCTP authentication key allocations as another controlled kmalloc-1024 spray mechanism. It defines numerous hardcoded structure offsets for Debian 6.12.95, indicating the exploit is tightly version-specific and tuned to that kernel layout. Operationally, the exploit appears to: create SCTP sockets and associations on loopback-style addresses/ports; trigger the SCTP ASCONF DEL-IP bug to free a target object; reclaim freed memory with crafted packet ring pages and/or SCTP auth-key objects; forge or pivot kernel pointers/fields; and then use arbitrary read/write-style primitives or forged transport state to achieve credential-impacting behavior leading to root. The truncated code still clearly shows post-exploitation validation logic: it checks whether /etc/shadow can be read, writes /root/SCTP_LPE_SUCCESS, optionally spawns /bin/sh, and otherwise execs /bin/sleep 120. Repository structure: - README.md: minimal usage instructions (compile statically with gcc and run ./lpe). - lpe_debian.6.12.95.c: full exploit implementation, including heap spraying, SCTP socket manipulation, diagnostic environment-variable controls, exploitation logic, and post-exploitation actions. - .gitignore: standard C/build artifact exclusions. Notable indicators and behaviors include direct writes to /proc/sys/net/sctp/auth_enable, use of AF_PACKET and SCTP socket options such as PACKET_TX_RING and SCTP_AUTH_KEY, loopback endpoints 127.0.0.1:20000 and 127.0.0.9:20001, and privileged file access/creation used to confirm successful escalation. Overall, this is a real, version-targeted, operational local kernel LPE PoC rather than a scanner or detection script.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
59 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Use-after-free vulnerability in the Linux kernel SCTP networking implementation that can allow local privilege escalation to root and container escape under certain conditions.
A Linux kernel use-after-free vulnerability in SCTP code that can be exploited for container escape and host root compromise under certain conditions.
A local privilege escalation vulnerability in the Linux kernel's SCTP implementation caused by improper handling of SCTP ASCONF state, enabling an attacker to obtain root privileges.
A Linux kernel SCTP vulnerability that can allow local privilege escalation to root, reportedly tied to improper handling of SCTP ASCONF state and a dangling or stale transport pointer.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.