A memory-corruption flaw in Linux’s SCTP (Stream Control Transmission Protocol) networking layer has been sitting in the kernel since 2008 and can now be exploited to gain full root on a vulnerable host — including from inside a container, according to Tencent’s Zhuque Lab, which found and tested the bug. The flaw, tracked as CVE-2026-64564 and named SCTPhantom, is a use-after-free: a carefully crafted sequence of address-manipulation messages tricks the kernel into freeing a network path object and then reusing the dangling pointer. Tencent’s researchers say they successfully escaped a default-configuration container in six of eight test attempts, reaching the host kernel on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS. The vulnerability was not in CISA’s Known Exploited Vulnerabilities catalog as of August 7, and no public exploit code had been released.
How to check if you’re affected
Affected versions include any Linux kernel older than 7.1.6, 6.18.42, 6.12.101, or 6.6.148, which were released on August 3 with the patch. Because Linux distributors often backport fixes without bumping the major kernel version, a version string alone may not tell you whether you are covered — check your distribution’s official security tracker (Red Hat Errata, Ubuntu Security Notices, Debian Security Advisories, etc.) for CVE-2026-64564. If SCTP is not needed on your system, loading the module can be blocked in your kernel configuration to eliminate the attack surface entirely.