Back Feeds.4Sysops

18-year

Feeds.4Sysops •IT News • August 7, 2026

A Linux kernel use-after-free flaw in SCTP, tracked as CVE-2026-64564 and dubbed SCTPhantom, has been used to escape containers and obtain root on the underlying host. Tencent Zhuque Lab reports six successful host-root escapes in eight attempts, even with the default seccomp profile and without `CAP_NET_ADMIN` or `CAP_SYS_ADMIN`. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SCTP Vulnerability in Linux Kernel Allows Root Access and Container Escape A serious Linux kernel vulnerability, identified as CVE-2026-64564 and named SCTPhantom, was disclosed on August 4, 2026. This use-after-free flaw in the SCTP Dynamic Address Reconfiguration feature enables local users to escalate privileges to root and escape containers. Tencent Zhuque Lab reported six successful host-root escapes in eight attempts, even under default seccomp profiles without elevated capabilities. The vulnerability poses a significant risk to systems running affected Linux kernel versions, allowing attackers to compromise the underlying host. The first public proof of concept (PoC) was released on August 7, 2026, raising immediate concerns about potential exploitation. System administrators are urged to monitor for signs of exploitation and apply necessary mitigations. 3 sources 70

Extracted Entities

18-year

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)