CVE-2026-64564Disclosure

CRITICAL

Exploitation observed; activity peaked at 11 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

Back to dashboard

8.3/ 10 priority

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Active exploitation appears in 4 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
55 mentions across 12 observed days

What's happening

Active exploitation reported across 4 signals
Exploit tool or code specified in 4 signals
PoC mentioned or linked in 9 signals
Patch or workaround mentioned in 22 signals
Technical details provided in 46 signals
Disclosure: 21 classified signals
General: 8 classified signals
Peaked 9d ago at 11 mentions (2026-08-07); latest day: 1
55 total mentions across 12 days

Deep dive

Activity timeline55 mentions / 12d

Signal classification6 categories

Disclosure

2138.9%

Patch

1425.9%

General

814.8%

PoC

713.0%

Active Exploitation

35.6%

Exploit

11.9%

Referenced assets65 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-04	3	Disclosure1Patch2
2026-08-06	3	Disclosure2PoC1
2026-08-07	11	Active Exploitation2Disclosure4Patch3PoC2
2026-08-08	10	Disclosure5General4Patch1
2026-08-09	10	Disclosure3General2Patch3PoC2
2026-08-10	8	Active Exploitation1Disclosure4Patch3
2026-08-11	2	Disclosure1General1
2026-08-13	3	Exploit1General1PoC1
2026-08-17	1	Patch1
2026-09-01	2	Disclosure1Patch1
2026-09-08	1	PoC1

Full discourse20 posts

The Hacker News@TheHackersNews43d
PoC
🛑 18-year-old Linux kernel flaw could let local users escape containers and reach host root. CVE-2026-64564 affects Linux SCTP code dating back to 2008. Tencent says SCTPhantom escaped a container and reached host root in 6 of 8 tests. How the flaw works: https://thehackernews.com/2026/08/18-year-old-linux-sctp-flaw-could-let.html
Post summary
Tencent’s SCTPhantom PoC demonstrates that CVE‑2026‑64564 lets local users escape Linux SCTP containers to reach host root.
54442176740.9K
2.3M followersView on X
Fourier@Khanmlgb44d
PoC
🚨 SCTPhantom (CVE-2026-64564) is an 18-year-old Linux kernel SCTP use-after-free. It can turn local low-privilege access into root and enable container-to-host escape. Exploit demo below. Technical details: https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564 https://t.co/qr4jZoKkuo
Post summary
The tweet shares a proof‑of‑concept demo and technical details for CVE‑2026‑64564, an old Linux kernel SCTP use‑after‑free that can lead to privilege escalation and container‑to‑host escape.
013239233.0K
15 followersView on X
إبراهيم بوحيمد | Ibrahim Buhaimed@buhaimedi41d
General
🚨تم اكتشاف ثغرة عمرها 18 سنة في كيرنل لينكس اطلق عليها SCTPhantom رقمها CVE-2026-64564 الثغرة تسمح بتصعيد الصلاحيات الى root وايضا تسمح للمهاجم يهرب من الكونتينر للسيرفر المضيف 😬 https://t.co/67ZKJzsdz4
Post summary
CVE-2026-64564 has been discovered in the Linux kernel, allowing privilege escalation to root and escaping from a container to the host. No exploit code or active exploitation evidence is provided.
12137203.8K
50.2K followersView on X
Linux Kernel Security@linkersec10d
PoC
SCTPhantom: An 18-Year-Old SCTP ASCONF Transport Use-After-Free Article about exploiting CVE-2026-64564 in the Stream Control Transmission Protocol (SCTP) implementation. Authors exploited a UAF in the kmalloc-1k cache to gain root and escape a container https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564 https://t.co/Zl6N3D5S70
Post summary
The article details a use‑after‑free vulnerability (CVE‑2026‑64564) in SCTP's kmalloc‑1k cache, presenting a proof‑of‑concept that demonstrates root escape from a container.
010037132.9K
10.5K followersView on X
dbugs@ptdbugs37d
Exploit
A PoC/exploit has been discovered for vulnerability CVE-2026-64564 Vendor: Linux Product: Linux Description: A flaw in the Linux kernel SCTP code, dating back to 2008, allows local users to escape containers and gain host root access. The issue occurs during DEL-IP processing within sctp process asconf(), which caches the transport being processed in asconf->transport. While sctp process asconf param() rejects a DEL-IP for the packet source address, it does not protect asconf->transport. An attacker can send a specifically crafted ASCONF containing an Address Parameter and a DEL-IP for that parameter, causing sctp assoc rm peer() to free the transport. A subsequent wildcard DEL-IP can then reuse this dangling pointer in sctp assoc set primary() and sctp assoc del nonprimary peers(). This leads to a state where asoc->peer.primary path and active path point to freed memory, and the association's transport count becomes 0. In real-world testing, a tool called SCTPhantom successfully escaped a container and reached host root in 6 out of 8 attempts. Link: https://github.com/hackspeak/cve-2026-64564 #dbugs_vuln
Post summary
A functional PoC and exploit tool, SCTPhantom, has been released for CVE-2026-64564, demonstrating container escape to host root via a kernel SCTP vulnerability.
06022121.6K
3.5K followersView on X
Linuxiac@linuxiac41d
Disclosure
The SCTPhantom vulnerability, CVE-2026-64564, affects Linux SCTP code and can be exploited for root access and container escape. https://linuxiac.com/18-year-old-linux-kernel-vulnerability-enables-root-access-and-container-escape/ #Linux #Kernel #OpenSource #Security
Post summary
The tweet highlights CVE-2026-64564 (SCTPhantom), noting it enables root access and container escape, but offers no evidence of active exploitation, PoC, or remediation.
0102701.2K
11.0K followersView on X
Журнал «Код»@thecode_media40d
Patch
В Linux нашли 18-летнюю уязвимость CVE-2026-64564 в протоколе SCTP, которая позволяет поднять права до root из контейнера через use-after-free. Исправление уже вышло — срочно обновите ядро (6.6.148, 6.12.101, 6.18.42, 7.1.6). https://v.thecode.media/rf5rk
Post summary
An 18‑year‑old use‑after‑free flaw in Linux’s SCTP protocol allows container‑to‑root privilege escalation; the issue has already been fixed in kernel releases 6.6.148, 6.12.101, 6.18.42, and 7.1.6, so users should immediately update.
0001262.6K
25.5K followersView on X
Daily CyberSecurity@Daily_CyberSec40d
Disclosure
A Linux SCTP kernel use-after-free (CVE-2026-64564) enables local privilege escalation and full container-to-host escape. #CVE202664564 #SCTPhantom #LinuxKernel #PrivilegeEscalation #ContainerEscape #InfoSec http://securityonline.info/sctp-uaf-cve-2026-64564-container-escape/
Post summary
The text announces CVE‑2026‑64564, describing it as a Linux SCTP kernel use‑after‑free that allows local privilege escalation and container‑to‑host escape, but offers no exploit code, patch information, or evidence of active exploitation.
05094734
12.9K followersView on X
NanoVMs@nanovms43d
Disclosure
this week in containers don't contain we see another escape via CVE-2026-64564 - SCTPhantom https://t.co/6SLkqMYN2T
Post summary
The tweet announces the discovery of a container escape vulnerability, CVE-2026-64564, and references a source link for further details.
020121773
2.2K followersView on X
Open Source Security mailing list@oss_security40d
Patch
CVE-2026-64564: Linux kernel: SCTP ASCONF transport UAF leading to local privilege escalation and container escape https://www.openwall.com/lists/oss-security/2026/08/06/3 Enterprise Linux distros blacklist the SCTP module by default by now
Post summary
Enterprise Linux distros mitigate CVE‑2026‑64564 by blacklisting the SCTP module; the post details the vulnerability type and fix but provides no PoC, exploit, or evidence of active exploitation.
030821.2K
4.7K followersView on X
みーくん＠限界サボリーマン(仮) Premiumプラスにしてみた@mmixx15_eve41d
General
本日話題になっているテクニカルポスト by Grok 集客・煽り抜きで、中身があったやつだけ。 1. macOS Screen Sharing 認証バイパス (CVE-2026-65400) パッチ差分から脆弱性を読む実例。 https://x.com/calif_io/status/2086022794840793454 2. Linux SCTP 18年物バグ → コンテナ脱出 (CVE-2026-64564 / SCTPhantom) cgroup/seccomp を厚くしても、到達可能なカーネル経路が残っていれば終わり。 https://x.com/TheHackersNews/status/2085686319548879018 3. Rails Active Storage + libvips の安全スイッチ未設定 (CVE-2026-66066) ライブラリ側の安全スイッチをアプリがオフのまま使う失敗パターン。 https://x.com/0xacb/status/2086031112178946555 4. メーカー公式 FW のバックドア (Zbtlink / ENDLESSDOORS) CVE が無い＝安全、ではない。 https://x.com/DFIR_Radar/status/2085683148742865323 5. BTCPay Server 緊急パッチ (運用者向け) 自前決済ノード運用者向け。 https://x.com/bitcoinwell/status/2085810273328255094 6. KEV / 実害寄り CVE ブリーフィング (N-central ほか) RMM 侵害は「1台で全エンドポイント」級。 https://x.com/UK_Daniel_Card/status/2085985401441825052 #security #linux #postgres #kubernetes
Post summary
The post lists several newly highlighted CVEs, noting a patch for BTCPay Server and briefly describing each vulnerability, but it does not provide PoC, exploit code, or evidence of active exploitation.
000120584
3.2K followersView on X
yousukezan@yousukezan43d
PoC
LinuxのSCTP処理に存在するUse-After-Free脆弱性「SCTPhantom」（CVE-2026-64564）が公開された。一般ユーザーがroot権限を取得できるほか、条件次第ではコンテナからホストへ脱出できる。 Corvus AIの調査で、SCTPのASCONF処理におけるアドレス検証と保持経路の不一致が原因と判明した。細工したDEL-IP処理により削除済みのtransportがprimary_pathやactive_pathに残り、後続処理で解放済みメモリが参照される。攻撃ではTPACKETのpg_vecで解放領域を再利用してカーネルアドレスを漏えいさせ、4バイト単位の任意読み取りからKASLRを特定し、commit_creds()を呼び出してroot権限を取得する。Debian 13、Rocky Linux 9、Ubuntu 24.04などで権限昇格を確認し、既定のseccompを維持したコンテナからホスト側root処理を実行する攻撃も8回中6回成功した。修正はLinux 6.6.148、6.12.101、6.18.42、7.1.6、7.2-rc5以降に取り込まれている。 https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564
Post summary
CVE‑2026‑64564, a use‑after‑free flaw in Linux SCTP, is publicly disclosed with a detailed PoC demonstrating root escalation and container escape; patches are available for affected kernel versions.
011641.8K
15.0K followersView on X
kokumօtօ@__kokumoto42d
General
18年物のLinuxカーネル脆弱性"SCTPhantom" (CVE-2026-64564)が修正された。ローカル権限昇格で、root取得可能。SCTP Dynamic Address ReconfigurationでのASCONFチャンクの取扱における解放後メモリ使用。 https://cybersecuritynews.com/18-year-old-linux-kernel-sctp-vulnerability/
Post summary
The post notes that a long‑standing Linux kernel defect (SCTPhantom, CVE‑2026‑64564) has been corrected and includes technical details about its privilege‑escalation nature, but gives no evidence of exploitation or mitigation guidance.
020721.2K
7.8K followersView on X
Julio Bandeira de Melo@juliobmelo40d
Disclosure
An 18-year-old vulnerability in the Linux kernel's SCTP protocol lets unprivileged local users escalate to full root and escape containers to compromise the underlying host. CVE-2026-64564 has been in the codebase since 2008 and affects virtually every Linux distribution running containerized workloads. The executive takeaway: legacy code in foundational infrastructure creates risk that no vulnerability scanner can fully enumerate. When your container orchestration platform runs on a kernel with an 18-year-old privilege escalation, the blast radius of a single compromised container extends to every workload on that host. https://cybersecuritynews.com/18-year-old-linux-kernel-sctp-vulnerability/ #Cybersecurity
Post summary
The article discloses an 18-year-old Linux kernel SCTP privilege escalation (CVE-2026-64564) that allows local users to escape containers to host root, but provides no exploit code, active‑use evidence, or patch details.
03042829
48.8K followersView on X
OS開発者@hacker_infra41d
General
CVE-2026-64564 systemdを使ったseccompでシステムコールをブロック設計がSCTPの脆弱性で回避される可能性が高いことがわかった。LPEの多層防御の設計をかんがなおさないといけないな・・・。頭痛いなー・・・。
Post summary
The post notes that CVE‑2026‑64564 may allow SCTP‐based bypass of systemd’s seccomp protections, prompting a review of multi‑layer LPE defenses.
01052508
2.9K followersView on X
Azubuike Ibe@ai_dev_official40d
Disclosure
An 18-year-old bug just gave researchers root. On multiple major distros. With a container escape attached. SCTPhantom, tracked as CVE-2026-64564, is a use-after-free in the Linux kernel’s SCTP ASCONF handling. The root cause traces back to code introduced in 2007. It sat there, unnoticed, for nearly two decades. Tencent Zhuque Lab’s Corvus AI project turned it into a working exploit chain. Local privilege escalation to root, demonstrated on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9, and OpenCloudOS. On containerized systems, the same flaw enables escape from the container to the host. There are real limits here. This is a local vulnerability, not remote. It requires SCTP to be reachable on the target, which is not enabled by default on every system. No public exploit code was available at time of disclosure. But fixes have already landed in stable kernel branches, which tells you how seriously maintainers are treating it. The lesson is not really about SCTP. It is about what “old code” means in a kernel that has been running in production for two decades. Old does not mean audited. Old does not mean safe. It means nobody has looked closely enough yet. In multi-tenant and containerized backends, a local privilege escalation with a container escape path is not a minor finding. It is the difference between one compromised workload and the whole host. Continuous kernel patching. Seccomp profiles that restrict which syscalls and protocols containers can touch. Minimal container privileges as a default, not an exception. My name is Azubuike Ibe and I write about the code that has been sitting quietly in production long enough for everyone to stop questioning it. When did you last fully patch and harden your production Linux kernels? Tell me your cadence. #Cybersecurity #LinuxKernel #ContainerSecurity #DevSecOps #AppSec
Post summary
Researchers disclosed a long‑standing use‑after‑free in Linux SCTP ASCONF that can lead to local privilege escalation with container escape; fixes are in place but no public exploit code exists yet.
12022112
1.5K followersView on X
Rıdvan Yağlı@ridvanyagli18d
Patch
🔴 SCTPhantom (CVE-2026-64564) ile ilgili upstream linux kernel için düzeltmeler ağustos başında yayınlandı. Açığın kullanılabilmesi için SCTP modülünün yüklenebilmesi gerekiyor. CloudLinux, AlmaLinux gibi dağıtımlara kernel patch geldi veya gelecek. KernelCare'de ise livepatch mevcut. Halen yapmadıysanız güncellemeyi unutmayın. 👉 Mitigation (geçici çözüm) uygulamak isteyenler: printf 'blacklist sctp\ninstall sctp /bin/false\n' > /etc/modprobe.d/99-sctphantom.conf
Post summary
The post announces that a kernel patch and a temporary mitigation script are available for CVE-2026-64564, urging users to update or apply the workaround.
00042942
2.3K followersView on X
Xavier Rivera@XavierRiveraX42d
Patch
SCTPhantom (CVE-2026-64564) is an 18-year-old use-after-free in Linux's SCTP code. Tencent researchers used it to escape a container and reach root on Debian 13, Ubuntu 24.04, Rocky Linux 9, and RHEL 9 builds. Patched in kernels 7.1.6, 6.18.42, 6.12.101, 6.6.148 (Aug 3).
Post summary
SCTPhantom is an 18‑year‑old use‑after‑free vulnerability in Linux SCTP that researchers successfully exploited to escape containers, but kernel updates released on Aug 3 patch the flaw across major distributions.
00042651
604 followersView on X
OS開発者@hacker_infra43d
Patch
echo "install sctp /bin/true" > /etc/modprobe.d/disable-sctp.conf 緩和策 https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564
Post summary
The post provides a specific command to disable the SCTP module as a mitigation for CVE‑2026‑64564, but offers no PoC, exploit, or evidence of active attacks.
01050352
2.9K followersView on X
ThreatWire@ThreatWire_37d
PoC
🚨 PoC RELEASED: CVE-2026-64564 is a Linux kernel SCTP flaw dating back to 2008 that can enable container escape to host root. The vulnerability is triggered by a use-after-free during SCTP ASCONF processing, allowing an attacker to corrupt kernel state and potentially break out of a container. Researchers report the SCTPhantom tool successfully achieved container-to-host root escape in 6/8 tests. 🔗 https://github.com/hackspeak/cve-2026-64564 #Linux #Kernel #SCTP #CVE #PoC #ContainerSecurity #CyberSecurity #Infosec
Post summary
A Proof‑of‑Concept for CVE‑2026‑64564 is released, showcasing container escape via a use‑after‑free in SCTP with the SCTPhantom tool, and the code is publicly available on GitHub.
00023685
1.5K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-64564

إبراهيم بوحيمد | Ibrahim Buhaimed[verified]@buhaimediGeneral

CVE-2026-64564 has been discovered in the Linux kernel, allowing privilege escalation to root and escaping from a container to the host. No exploit code or active exploitation evidence is provided.

dbugs[verified]@ptdbugsExploit

A functional PoC and exploit tool, SCTPhantom, has been released for CVE-2026-64564, demonstrating container escape to host root via a kernel SCTP vulnerability.

Linuxiac[verified]@linuxiacDisclosure

The tweet highlights CVE-2026-64564 (SCTPhantom), noting it enables root access and container escape, but offers no evidence of active exploitation, PoC, or remediation.

みーくん＠限界サボリーマン(仮) Premiumプラスにしてみた[verified]@mmixx15_eveGeneral

The post lists several newly highlighted CVEs, noting a patch for BTCPay Server and briefly describing each vulnerability, but it does not provide PoC, exploit code, or evidence of active exploitation.

yousukezan[verified]@yousukezanPoC

CVE‑2026‑64564, a use‑after‑free flaw in Linux SCTP, is publicly disclosed with a detailed PoC demonstrating root escalation and container escape; patches are available for affected kernel versions.

kokumօtօ[verified]@__kokumotoGeneral

The post notes that a long‑standing Linux kernel defect (SCTPhantom, CVE‑2026‑64564) has been corrected and includes technical details about its privilege‑escalation nature, but gives no evidence of exploitation or mitigation guidance.

Julio Bandeira de Melo[verified]@juliobmeloDisclosure

The article discloses an 18-year-old Linux kernel SCTP privilege escalation (CVE-2026-64564) that allows local users to escape containers to host root, but provides no exploit code, active‑use evidence, or patch details.

OS開発者[verified]@hacker_infraGeneral

The post notes that CVE‑2026‑64564 may allow SCTP‐based bypass of systemd’s seccomp protections, prompting a review of multi‑layer LPE defenses.