SCTPhantom (CVE-2026-64564): 18-Year-Old Linux Kernel Bug Enables Root Escape
Harish Kumar 
A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-64564 and nicknamed SCTPhantom, shows how a design decision baked into the kernel back in 2007 quietly matured into a full container-to-host escape chain.
The bug lived undetected in SCTP’s Dynamic Address Reconfiguration (ASCONF) code for nearly two decades before AI-assisted research pipeline Corvus AI, built by the TencentOS Security Team, surfaced and weaponized it.
SCTPhantom is a use-after-free vulnerability in the way Linux handles ASCONF chunks defined in RFC 5061. The flaw stems from an identity mismatch: the kernel validates a DEL-IP operation against the IPv4 packet’s source address, but later processing relies on a different address, the one specified in the ASCONF Address Parameter.
SCTPhantom (CVE-2026-64564)
When an attacker crafts a sequence targeting a specific address, followed by a wildcard deletion for 0.0.0.0, the kernel deletes the wrong transport while still holding a stale pointer to it in the association’s primary and active path fields. Any later socket operation that touches those cached pointers dereferences freed memory.
The root cause traces back to a 2007 commit (Linux 2.6.25) that introduced the wildcard handling that completed the vulnerable sequence, making this one of the longest-lived exploitable bugs in the SCTP stack.
What makes SCTPhantom notable isn’t just the memory corruption bug itself; it’s how far researchers pushed it. Corvus AI turned the raw use-after-free into a full privilege-escalation chain by reclaiming the freed transport slot using a TPACKET pg_vec allocation, which leaked a kernel direct-map address.
That leak enabled a repeatable 4-byte kernel read primitive, which was then used to defeat KASLR by reading the CPU entry area’s IDT gate.
A second UAF, reclaimed with attacker-controlled SCTP authentication-key data, built a fake kernel object graph that ultimately triggered a data-oriented commit_creds() call, granting global root without shellcode or a traditional ROP chain.
Researchers then extended the exploit into containerized environments. By enabling ASCONF and AUTH support at the socket level, rather than through sysctls that would require CAP_NET_ADMIN, the team achieved host root from inside a container with default seccomp and no elevated capabilities, succeeding in six of eight attempts.
The vulnerability carries a CVSS v4.0 base score of 8.5 (High), reflecting its local, low-complexity path to full system compromise.
It was validated across Debian 13, Ubuntu 24.04, Rocky Linux 9, and an OpenCloudOS-family target, achieving root on every tested distribution.
Fixed kernel versions include 6.6.148, 6.12.101, 6.18.42, and 7.1.6, with the mainline fix landing via commit 9b2854f86f0b, which now explicitly rejects deletion of the transport still referenced by the ASCONF chunk.
SCTPhantom underscores two uncomfortable truths for defenders: protocol code with complex state machines, such as SCTP, remains a persistent blind spot for traditional static analysis, and AI-driven research pipelines can now turn obscure logic bugs into reliable, cross-distribution root exploits.
Organizations running SCTP-enabled kernels, particularly in telecom, container, and multi-tenant cloud environments, should prioritize patching to the fixed versions immediately, since vendor kernels may backport the fix without a version bump that’s easy to spot.
About the Author
Kiran 
