18-year-old Linux SCTP flaw gives local root and can escape containers

Tencent researchers disclosed SCTPhantom, a use-after-free flaw in the Linux kernel's SCTP networking code that lets a local user gain root and, in some configurations, escape a container to the host. Tracked as CVE-2026-64564, the bug is in the protocol's dynamic address reconfiguration handling and traces to code introduced around 2008, making it roughly 18 years old. It is local rather than remote and needs SCTP reachable on the target, which limits exposure, but where those conditions hold the researchers gained root on several major distributions. It was found by an AI-assisted kernel research pipeline, the latest long-dormant kernel bug surfaced that way this year.

Check

Update to a fixed kernel, checking your distribution's tracker rather than the version string since vendors backport, and where SCTP is not needed, block the module to remove the attack surface.

Affected

Linux systems with SCTP reachable and an unpatched kernel (CVE-2026-64564); a local user can gain root, and in some container configurations escape to the host, though remote exploitation is not possible.

Fix

Apply the distribution kernel update and reboot, disable the SCTP module where unused, and tighten container policies that grant network and packet-socket capabilities to untrusted workloads.