18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
- ID
- 11937
- Status
- summarized
- Published
- 07 Aug 2026, 7:10 PM
- Fetched
- 07 Aug 2026, 9:51 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/18-year-old-linux-sctp-flaw-could-let.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.5
- Created
- 07 Aug 2026, 9:55 PM
- Tags
- Audience
- developersdatabase_learners
What happened
An 18-year-old use-after-free bug in Linux's SCTP networking code (CVE-2026-64564, dubbed 'SCTPhantom') allows local users to gain root and escape containers. Tencent Zhuque Lab demonstrated container escape on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS using default seccomp without CAP_NET_ADMIN. Fixes shipped August 3 in kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148; no public exploit code exists yet and it's not in CISA's KEV catalog.
Why it matters
If you run multi-tenant container platforms or shared Linux hosts with SCTP enabled, patch your kernels now—the bug has been present since Linux 2.6.25 (2008) and the container escape path works without special capabilities. If SCTP isn't reachable on your hosts, exposure is limited since the flaw is local-only, not remote.
Discussion angle
Whether your infrastructure actually exposes SCTP—most workloads don't use it, so the real question is whether your kernel hardening or seccomp profiles already block it, or if you're running unpatched kernels on shared hosts where a local user could reach it.