18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
An 18-year-old Linux SCTP flaw allows local users to gain root and escape containers.
A critical use-after-free vulnerability in Linux's SCTP networking code, present since 2008, has been patched. Researchers from Tencent demonstrated that this flaw, tracked as CVE-2026-64564 and named SCTPhantom, can be exploited by local users to gain root privileges on a host system and even escape containerized environments. The vulnerability requires SCTP to be reachable on the target system, and fixes have been backported to several stable kernel versions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Tencent?
Get an email when a new story names Tencent, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA use-after-free vulnerability in the Linux kernel's SCTP networking subsystem went undetected for 18 years, illustrating how legacy code in widely-deployed systems can harbor critical flaws across an enormous attack surface. Exploiting this flaw allows local users to escalate privileges to root and break out of containerized environments, fundamentally undermining container isolation guarantees that many organizations rely on for workload security. The long lifespan of this vulnerability highlights the danger of assuming that mature, well-used code is inherently secure. Organizations running Linux-based systems or container workloads — which represents a vast portion of modern infrastructure — must treat kernel-level privilege escalation vulnerabilities as top-priority incidents requiring immediate patching.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-64564