If you run Linux — on a server, a desktop, or inside a container — there is a high-severity kernel vulnerability you need to patch right now. CVE-2026-64564, nicknamed SCTPhantom by researchers at Tencent's Zhuque Lab, was disclosed on August 6–7, 2026. The bug has been sitting in the Linux kernel since December 2007 — nearly 18 years — undetected.
What the Bug Does
SCTPhantom lives in the SCTP (Stream Control Transmission Protocol) subsystem, specifically in the Dynamic Address Reconfiguration (ASCONF) code path. It is a use-after-free vulnerability: memory that has already been freed is accessed again, and under the right conditions an attacker can turn that into arbitrary code execution with kernel privileges.
The practical impact is severe. An unprivileged local user can escalate to full root on the host. More critically for cloud and containerized environments, the exploit enables container escape — an attacker inside a Docker or Kubernetes container can break out to compromise the underlying host machine. In a shared hosting or multi-tenant environment, that means one compromised container can threaten everything else running on the same machine.
Who Is Affected
The vulnerable code was introduced in Linux kernel 2.6.25. Any distribution shipping a kernel derived from that version — which is essentially all of them — is affected unless patched. Confirmed vulnerable distributions include:
- Debian 13
- Ubuntu 24.04 LTS
- Rocky Linux 9
- Red Hat Enterprise Linux 9
- OpenCloudOS
If your kernel is older than the patched versions listed below, assume you are vulnerable.
Patches Are Available — Update Now
Fixes have been backported to all active stable branches. The patched kernel versions are:
- 6.6.148 (LTS, supported through December 2027)
- 6.12.101 (LTS, supported through December 2028)
- 6.18.42 (LTS, supported through December 2028)
- 7.1.6 (mainline)
Notably, new LTS stable kernels (6.18.44, 6.12.103, 6.6.151) were pushed on August 9th — if you've already updated to those, you're covered. For Ubuntu users, running sudo apt update && sudo apt upgrade and rebooting will pull the fix automatically once Canonical has pushed it to their repositories.
Why Did It Take 18 Years?
The SCTP protocol is relatively niche — most traffic runs over TCP or UDP — which means the affected code path sees less scrutiny than the network stack's more heavily trafficked corners. Use-after-free bugs can also be notoriously hard to trigger deterministically; they often require precise timing and memory layout, making them easy to miss in automated fuzz testing unless the fuzzer is specifically targeting that subsystem.
Tencent's Zhuque Lab hasn't disclosed exactly how they found the bug, but the disclosure follows the responsible disclosure timeline — patches were prepared before public announcement, and no in-the-wild exploitation has been confirmed as of the disclosure date.
Workaround If You Can't Patch Immediately
If an immediate kernel update isn't possible, you can disable the SCTP module:
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo modprobe -r sctpThis blocks SCTP entirely and mitigates the vulnerability without a reboot, though it will break any services that rely on SCTP (rare for most deployments, but check before applying). The proper fix remains patching to a fixed kernel version as soon as your distribution makes one available.
Sources: The Hacker News — SCTPhantom disclosure · Linuxiac — vulnerability details · Privacy Guides — full system takeover