This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Linux fixes high-severity vulnerability "SCTPhantom"

Linux Kernel fixes the high-severity "SCTPhantom" vulnerability affecting the SCTP (Stream Control Transmission Protocol) subsystem. The vulnerability affects the kernel since version 2.6.25, or more precisely since commit 42e30bf3463c [1][2]; the fix is in commit 74e8f3e7114f [3], which is a backport of upstream commit 9b2854f86f0b [4]. Debian has released a fix in version 6.12.101-1 for trixie and 7.1.7-1 for forky/sid [5]. Neither Ubuntu [6] nor Red Hat [7] has released a fix yet.

Linux Kernel (SCTP) - LPE (CVE-2026-64564)
CVSS 8.5 (High)

An authenticated local attacker can, by sending a specially crafted ASCONF message exploiting a mismatch between the packet's source address and the address given in its Address Parameter, exploit a use-after-free vulnerability in the ASCONF (Dynamic Address Reconfiguration) mechanism of the SCTP subsystem and thereby escalate their privileges up to root level. In a containerized environment, it is possible under certain conditions to escape to the host system. Exploitation of the vulnerability has been verified in practice at [1]. Instances with the sctp module active are vulnerable, while e.g. on RHEL [7] and CIQ commercial products built on Rocky Linux [8] the module is blocked by default. If an immediate update to a fixed version is not possible, the risk can be temporarily mitigated by blocking loading of the sctp module, which, however, terminates all active SCTP associations; for RHEL/CIQ products this is described at [7][8].

CVSS: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

More information:

The vulnerability was publicly disclosed 4. 8. 2026.

By CESNET, z.s.p.o. Táňa Macháčková on 10. 8. 2026.

CESNET, z.s.p.o. Logo