An eighteen-year-old Linux kernel flaw hands ordinary users root

Tencent Zhuque Lab disclosed a vulnerability in the networking part of the Linux kernel on 6 August, numbered CVE-2026-64564 and named SCTPhantom. The flaw sits in the SCTP protocol, and lets a user without special privileges gain root on the machine. According to the finders the flaw entered the kernel with version 2.6.25 in 2008. Fixed stable kernels were released on 3 August, in versions 7.1.6, 6.18.42, 6.12.101 and 6.6.148. Tencent puts the severity at 8.5 under CVSS 4.0, while NVD has not assigned a score.

What happens technically

SCTP is a transport protocol alongside TCP, and it has a property TCP lacks. One association can use several IP addresses at the same time, and the addresses can change while the association is up. The changes are sent as messages of the ASCONF type, where one party asks for an address to be added or removed. The kernel tracks each address in a structure of its own, called a transport, and the association additionally holds its own pointers to the primary and the active path. It is the interplay between those pointers and the clean-up after a removed address that fails.

The flaw is a case of mistaken identity. The kernel validates a removal request against the source address of the packet itself, but it acts on the transport the message was looked up through, and the two need not be the same. Tencent shows an ordering where removal of one address passes the check and frees the transport, while a following removal using the wildcard address 0.0.0.0 reuses the stored pointer to what was just freed. Later operations on the association then follow a pointer with no valid target, and that is the hole being exploited. The attack requires the SCTP module to be loaded, the attacker to hold an account on the machine, and two settings to be enabled on the attacker's own socket. The finders stress that no global system settings need to be changed, and that escaping a container requires neither CAP_NET_ADMIN nor CAP_SYS_ADMIN.

What this means for you if you run Linux servers

The way we read this, the case matters most to you if you share a machine with others. A vulnerability that lifts an ordinary user to root turns the boundary between two workloads on the same host into a thin line. Tencent demonstrated root on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9 and OpenCloudOS. If any of those are in production on your machines, this one is yours.

Your simplest barrier is not the update, but the module. SCTP is not a protocol most organisations actively use, and a kernel that does not load the module cannot be reached by this attack. If you block the loading of modules nobody uses, that also works the next time a flaw appears in a protocol nobody knew the machine supported. According to The Hacker News there is still no public exploit code. The issue was not in CISA's catalogue of exploited vulnerabilities when the article was written.

Berigo recommends

• Update to a fixed kernel, meaning 7.1.6, 6.18.42, 6.12.101 or 6.6.148, or to your vendor's equivalent release.
• Check whether the SCTP module is loaded on your machines, and block loading where the protocol is not used.
• Prioritise hosts with several users or containers, since that is where the lift from ordinary user to root matters most.
• Ask your managed service provider to confirm in writing which kernel versions are running, and when they were last updated.
• Remember that RHEL 9 and Rocky Linux 9 run a vendor kernel of their own, and follow that vendor's own advisory.