INFRA Signal 466
18-Year-Old Linux Kernel Vulnerability Enables Root Access and Container Escape
↗
A long-standing use-after-free bug in the Linux SCTP implementation (CVE-2026-64564) can be chained to gain root privileges and break out of containers.
The flaw lets a local, low-privilege attacker obtain full kernel control, which defeats typical isolation guarantees of containers. Because the vulnerability has existed since the 2.6.25 kernel, many production systems may still run affected versions, requiring urgent patching or mitigation.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The SCTPhantom bug resides in SCTP Dynamic Address Reconfiguration and creates a dangling pointer that can be exploited for arbitrary kernel reads and writes.
Researchers demonstrated a repeatable exploit that bypasses KASLR, builds a malicious kernel object graph, and calls commit_creds() to achieve root, even from inside a container with default seccomp settings.
Upstream Linux provides a concise patch that stops the erroneous transport deletion; fixed kernels appear in 6.6.148, 6.12.101, 6.18.42, 7.1.6 and later, and distributions must ship the update for affected releases.
THE CLUSTER