What Happened
Tencent Zhuque Lab disclosed CVE-2026-64564, a use-after-free vulnerability in the Linux kernel’s SCTP Dynamic Address Reconfiguration feature. The flaw traces back to code introduced in Linux 2.6.25 in December 2007, making it an 18-year-old bug present in essentially every Linux kernel in common use today. Researchers named the flaw SCTPhantom.
The vulnerability stems from an identity mismatch in how the kernel processes SCTP DEL-IP delete operations. The kernel validates the operation using the packet’s source address, but a separate cached pointer relies on the address parameter used to select the actual network path. An attacker with unprivileged local access to a system where SCTP is reachable triggers the mismatch to achieve a use-after-free condition, then exploit it to gain full root on the kernel. Tencent’s researchers confirmed successful root exploitation on Debian 13, Ubuntu 24.04, Rocky Linux 9, and RHEL 9, and they used the same flaw to escape a container and reach the underlying host machine. The flaw was publicly disclosed on August 6, two days after the kernel CVE team assigned the identifier. Stable kernel patches have been backported to branches 6.6.148, 6.12.101, 6.18.42, and 7.1.6. No public exploit code had surfaced by the time of disclosure, and the flaw does not appear in CISA’s Known Exploited Vulnerabilities catalog as of August 7.
Why This Matters for Canadian Organizations
Linux is the foundation of Canadian enterprise and government cloud infrastructure. Container workloads running on affected kernel versions — particularly Kubernetes clusters on RHEL 9 or Ubuntu 24.04 — face a concrete risk: a compromised container, or an attacker gaining any foothold in a containerised environment breaks out of the container boundary entirely and reaches the host operating system and every workload running alongside it. In multi-tenant environments, the result is lateral movement from one customer or application to another.
Canadian public sector organisations running Red Hat Enterprise Linux 9 and cloud operators on Ubuntu 24.04 LTS should treat this as a high-priority patch. For organisations subject to OSFI Guideline B-13, unpatched Linux container infrastructure represents a control gap in technology risk management. A container escape enabling access to data across tenant boundaries triggers PIPEDA breach reporting obligations. Healthcare providers, financial institutions, and government departments running containerised workloads should prioritise kernel updates before addressing lower-severity items in their patch queue.
What to Do
Update the Linux kernel to a patched version immediately: 6.6.148, 6.12.101, 6.18.42, or 7.1.6 for mainline builds. For distribution-specific packages, apply the latest RHEL 9, Rocky Linux 9, Debian 13, and Ubuntu 24.04 security updates as vendors release them. Where kernel updates require downtime, assess whether SCTP is enabled and reachable in your environment — if not needed operationally, disable the SCTP kernel module as a temporary mitigation. For container environments, prioritise nodes running multi-tenant or cross-application workloads. Review container breakout detection in your EDR or runtime security tooling and confirm you have alerting for unexpected privilege escalation at the host level. Security teams should check whether SCTP traffic appears in network flow logs for systems where it has no legitimate purpose and block it at the perimeter if so.
Source: The Hacker News
