Linux SCTP bug lets local users hit root and escape containers

A use-after-free in the Linux kernel’s SCTP stack can turn a local low-privilege account into root and, on container hosts, into host root. Tracked as CVE-2026-64564 and disclosed by Fourie Zhang under the name SCTPhantom, the flaw sits in Dynamic Address Reconfiguration (ASCONF) handling.

When the kernel processes an ordered sequence of ASCONF chunks, it can free a transport object and then reuse the dangling pointer while updating primary and peer addresses. The trigger is deterministic: it needs only local access, low privileges, and no user interaction. CVSS v4.0 rates the base score 8.5 (High), with full impact on kernel confidentiality, integrity, and availability.

The vulnerable path has been present since Linux 2.6.25. Fixes are in mainline and in stable releases including 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5; vendor kernels may ship backports on older base versions. Zhang’s team reported successful root on Debian 13, Rocky Linux 9 / RHEL 9-family kernels with SCTP loaded, and Ubuntu 24.04.

Operators who load SCTP should treat this as a priority patch, especially on multi-tenant and container hosts where a guest or pod breakout reaches the host.