CVE-2026-64564

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw in the Linux kernel SCTP code, dating back to 2008, allows local users to escape containers and gain host root access. The issue occurs during DEL-IP processing within sctp process asconf(), which caches the transport being processed in asconf->transport. While sctp process asconf param() rejects a DEL-IP for the packet source address, it does not protect asconf->transport. An attacker can send a specifically crafted ASCONF containing an Address Parameter and a DEL-IP for that parameter, causing sctp assoc rm peer() to free the transport. A subsequent wildcard DEL-IP can then reuse this dangling pointer in sctp assoc set primary() and sctp assoc del nonprimary peers(). This leads to a state where asoc->peer.primary path and active path point to freed memory, and the association's transport count becomes 0. In real-world testing, a tool called SCTPhantom successfully escaped a container and reached host root in 6 out of 8 attempts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.