Quick Takeaways
- A long-standing use-after-free bug in Linux’s SCTP code (CVE-2026-64564) allows local attackers to escalate privileges to root, especially where SCTP is reachable.
- Exploits can potentially escape containers and compromise the host system by manipulating network paths due to improper handling of connection identities.
- The vulnerability’s severity is high (CVSS 8.5), with no public exploit code confirmed, but updates to kernel versions 6.6.148, 6.18.42, 7.1.6, and 6.12.101 are strongly recommended.
Threat, Attack Techniques, and Targets
The vulnerability is a use-after-free bug in Linux’s SCTP networking code. It has existed since 2008. Attackers can exploit this flaw to gain full root access on a host system. The flaw allows attackers to escape from containers and reach the underlying machine. Tencent researchers confirmed that they used this flaw to escape containers and obtain root privileges. The attack requires that SCTP is reachable on the target system. This means the attacker must have local access to the system and the SCTP protocol must be enabled and accessible. The attack involves sending specially crafted messages to manipulate the kernel. These messages trick the kernel into freeing memory and then reusing it. This process leaves the connection pointing at memory that the kernel has already released. The flaw has been present in all Linux kernels since 2008, including popular distributions like Debian, Ubuntu, Rocky Linux, RHEL, and OpenCloudOS.
Impact, Security Implications, and Remediation Guidance
The flaw can give an attacker root access on a Linux system. This can lead to full control over the system and its data. The ability to escape containers increases the risk of lateral movement within a network. Currently, no public exploit code is known, and the flaw has limited exposure because it requires local access and reachable SCTP. The vulnerability has been fixed in recent stable kernel releases (7.1.6, 6.18.42, 6.12.101, and 6.6.148). Users using older kernels should update to the latest versions to protect their systems. Since vendors often backport fixes, check your distribution’s update tracker. For systems not needing SCTP, removing the module can prevent exploitation. For detailed steps and guidance, users should contact their software vendors or consult official security resources.
Discover More Technology Insights
Explore the future of technology with our detailed insights on Artificial Intelligence.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
