Affected Systems

Linux kernel versions since 2.6.25 (2008) through 7.1.5, 6.18.41, 6.12.100, and 6.6.147. Affects systems with SCTP networking enabled. Confirmed vulnerable: Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, OpenCloudOS. Fixed in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148 released August 3, 2026.

Exploitation Status

No public exploit code available as of August 7, 2026. Not listed in CISA KEV catalog. Tencent Zhuque Lab demonstrated proof-of-concept achieving root in 6 of 8 container escape attempts. Requires local access and SCTP reachability, limiting exposure.

Business Impact

Use-after-free vulnerability (CVE-2026-64564, "SCTPhantom") in SCTP dynamic address reconfiguration allows local users to escalate privileges to root and potentially escape containers to compromise the host. Exploitation requires local access and SCTP protocol availability. NVD has not yet published CVSS score; Tencent assigned 8.5 (CVSS v4.0). Attack complexity is moderate—requires specific SCTP features but researcher claims CAP_NET_ADMIN not required. Container escape depends on runtime configuration, seccomp profiles, and namespace policies. One vendor (openKylin) assesses impact as kernel panic/DoS only. Patches available since August 3; vendors may have backported fixes without version number changes.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Update to patched stable kernels: 7.1.6, 6.18.42, 6.12.101, or 6.6.148 released August 3, 2026. Verify patch status via distribution security tracker, not kernel version string alone.
  • If SCTP is not required, block the sctp kernel module (e.g., 'install sctp /bin/true' in /etc/modprobe.d/) to eliminate attack surface.
  • Review container configurations: audit seccomp profiles, user namespace policies, and CAP_NET_ADMIN grants to reduce escape risk where SCTP cannot be disabled.
  • Check for net.sctp.addip_enable and net.sctp.addip_noauth_enable sysctl settings; disable if not operationally required.
  • Monitor for abnormal SCTP socket creation or privilege escalation attempts in container environments via auditd or runtime security tooling.

---

# Threat Actor Context

Actor Profile

This analysis covers CVE-2026-64564 (SCTPhantom), a use-after-free vulnerability in Linux kernel SCTP networking code discovered by Tencent Zhuque Lab using their Corvus AI research pipeline. The flaw is not attributed to a threat actor but represents a technical vulnerability that existed undetected since Linux kernel 2.6.25 in 2008. Tencent researchers disclosed the vulnerability publicly on August 6, 2026, two days after kernel CVE assignment, following coordinated disclosure practices. The discovery was made through automated machine-assisted kernel analysis rather than adversarial exploitation.

TTPs (Tactics, Techniques, Procedures)

The vulnerability enables local privilege escalation via use-after-free exploitation in SCTP dynamic address reconfiguration. Key techniques include: T1068 (Exploitation for Privilege Escalation) - leveraging the kernel use-after-free to gain root privileges from unprivileged local user context; T1611 (Escape to Host) - demonstrated container escape reaching the underlying host system from within containerized environments; T1543.002 (Create or Modify System Process: Systemd Service) - potential post-exploitation technique after gaining root. The exploit targets SCTP transport protocol's address reconfiguration feature, where the kernel incorrectly validates delete requests against packet source addresses but acts on different addresses within the message payload, creating a dangling pointer condition. Tencent achieved 6 of 8 successful host escapes without requiring CAP_NET_ADMIN or CAP_SYS_ADMIN capabilities.

Targets & Patterns

The vulnerability affects technology sectors relying on Linux infrastructure, particularly cloud computing providers and container orchestration platforms. Primary exposure exists in environments where: (1) SCTP networking is enabled and reachable to local users, (2) multi-tenant container infrastructure allows unprivileged user access, and (3) legacy kernel versions remain deployed. Tencent confirmed exploitation on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS. Container platforms represent high-value targets due to the demonstrated escape capability, allowing malicious tenants to break isolation and compromise host systems. The local-only nature limits remote attack scenarios but creates significant risk in shared hosting, cloud environments, and systems with untrusted local users. Organizations running containerized workloads on affected kernel versions face the highest risk profile.

Historical Context

SCTPhantom represents the latest in a series of long-dormant Linux kernel vulnerabilities discovered through machine-assisted analysis in 2026, following GhostLock disclosed in July 2026. The 18-year latency period (2008-2026) demonstrates the challenge of identifying complex use-after-free conditions in kernel networking code. The flaw existed across every Linux kernel release since 2.6.25, affecting nearly two decades of production systems. The August 3, 2026 stable kernel releases (7.1.6, 6.18.42, 6.12.101, 6.6.148) addressed SCTPhantom alongside Zapscape, an unrelated KVM escape vulnerability. A second related use-after-free in SCTP code was patched August 6, after the initial stable releases. No public exploit code or CISA KEV listing existed as of August 7, 2026, though the technical disclosure provides sufficient detail for weaponization.

Defensive Recommendations

  • Immediately update to patched stable kernels: 7.1.6, 6.18.42, 6.12.101, or 6.6.148 released August 3, 2026, and verify vendor-specific backports via distribution security trackers
  • Disable SCTP kernel module if not operationally required using 'modprobe -r sctp' and blacklist via /etc/modprobe.d/ to eliminate attack surface entirely
  • Implement enhanced container security policies: restrict socket access, enforce strict seccomp profiles blocking SCTP-related syscalls, and enable user namespace isolation to limit exploitation paths
  • Monitor for T1068 privilege escalation indicators: unexpected root process creation from unprivileged users, kernel panic events, and abnormal SCTP socket operations via auditd rules targeting socket(AF_INET, SOCK_STREAM, IPPROTO_SCTP)
  • Deploy runtime container security monitoring to detect T1611 escape attempts: file access outside container namespaces, unexpected host filesystem interactions, and privilege boundary violations