CVE-2026-64564, named SCTPhantom, is a use-after-free in Linux's SCTP address-reconfiguration code that turns an unprivileged local shell into root and lets an attacker escape a container onto the host. The flawed code shipped in December 2007 and is fixed in kernels 6.6.148, 6.12.101, 6.18.42 and 7.1.6.
Read the full story: SCTPhantom: an 18-year-old Linux bug that hands out root →
Transcript
There is a bug in Linux that shipped in December 2007 and nobody caught it until last month. It's called SCTPhantom. Here's the trick. Linux lets a connection add and drop network paths while it's running. When you ask it to delete one, the kernel checks the address in the packet. But it remembers a different address, the one inside the message. Normally those match. Make them disagree and you delete a path the kernel is still holding a pointer to. Three packets and it's pointing at memory that's already gone. From there it's root. And if you're in a container, it's root on the machine underneath, which worked six times out of eight. Patch to 6.6.148, 6.12.101, 6.18.42 or 7.1.6. And patch the host, not the image. The container shares that kernel. If you don't actually use SCTP, and almost nobody does, just blacklist the module and be done with it.