Discovery of SCTPhantom: A High-Severity Linux Kernel Vulnerability
The cybersecurity community has identified a significant vulnerability in the Linux kernel known as SCTPhantom, classified under the identifier CVE-2026-64564. This high-severity flaw pertains to a use-after-free condition within the Dynamic Address Reconfiguration implementation of the Stream Control Transmission Protocol (SCTP). Researchers from Tencent Zhuque Lab’s Corvus AI project highlighted that local attackers could exploit this vulnerability to escalate their privileges to root level. Furthermore, in specific configurations, the flaw could enable malicious entities to escape from containers, jeopardizing the security of the host system.
Technical Overview of the Vulnerability
The root of the issue lies within SCTP’s ASCONF (Address Configuration Change) handling logic. SCTP is designed to support multihoming, which implies the ability for a single association to maintain multiple network paths. The Linux kernel keeps track of these paths using struct sctp_transport objects. Meanwhile, pointers at the association level, including primary_path and active_path, are intended to reference valid, live transports.
SCTPhantom arises when SCTP processes a meticulously crafted, ordered ASCONF sequence. In this scenario, a transport object may be removed while a lingering reference to it persists in the association. Consequently, subsequent socket operations may access the freed object, leading to a critical use-after-free condition. The underlying cause stems from inconsistent identity management during the DEL-IP operation, where a distinction is made between the IPv4 packet source address and the SCTP Address Parameter employed to select the relevant peer transport.
An attacker has the capability to craft an ASCONF message that can utilize one address for source validation while simultaneously selecting another address for the transport involved in subsequent processing activities. By executing a series of carefully ordered deletion operations, the attacker can eliminate the chosen transport and subsequently utilize a wildcard deletion path to repurpose its cached pointer. This situation results in the primary_path and active_path pointers potentially referencing freed memory regions.
What makes the SCTPhantom vulnerability particularly alarming is its long history; the problematic wildcard-handling behavior has been part of the Linux kernel since version 2.6.25, making it almost 18 years old. This longevity underscores the need for vigilance in securing systems against both newly discovered and longstanding vulnerabilities.
Conditions for Exploitation
Exploitation of this vulnerability demands local access and specific environmental conditions, notably including the availability of SCTP and the capability to reach relevant socket functionality. The researchers from Corvus AI succeeded in developing a crash into a demonstrable local privilege-escalation chain across various Linux distributions and kernel versions.
Their research relied on controlled heap reallocation alongside a stale SCTP path reference to achieve kernel memory disclosure and subsequently manipulate the relationships between kernel objects. Rather than utilizing conventional user-space shellcode or a return-oriented programming chain, the technique leverages existing kernel code paths to directly invoke credential-changing functionalities.
Tencent has confirmed the success of their exploitation techniques through root-only filesystem access, enabling the creation of root-owned files on various tested systems, which include Debian 13, Ubuntu 24.04, and Rocky Linux 9, among others. The implications of such exploits could lead to critical vulnerabilities across a broad spectrum of Linux distributions.
Mitigation Strategies
In light of these alarming discoveries, the Linux development community has acted decisively. The flaw was addressed in commit 9b2854f86f0b, which prevents the deletion of transports retained for ASCONF operations. The first fixed releases include significant kernel versions such as 6.6.148, 6.12.101, 6.18.42, and the mainline 7.2-rc5.
Organizations are urged to promptly apply their distribution’s kernel updates to mitigate potential exposures and verify the status of vendor backports. Regularly rebooting affected hosts is also crucial. For a more comprehensive defense, system administrators should disable SCTP where it is not essential, limit untrusted local workloads, and carefully scrutinize container policies that could expose network and packet-socket capabilities.
Overall, the SCTPhantom vulnerability raises critical security concerns for Linux users and encapsulates the ongoing risks that both longstanding and emerging vulnerabilities pose to system integrity. With the increasing complexity of today’s digital environments, maintaining security vigilance is more essential than ever.