OSG-SEC-2026-08-06 HIGH-Linux kernel vulnerability-SCTPhantom

Dear OSG Security Contacts,

A Linux kernel vulnerability, CVE-2026-64564 ("SCTPhantom"), has been publicly disclosed [1]. The vulnerability affects the kernel's SCTP (Stream Control Transmission Protocol) implementation and has been demonstrated by researchers to enable local privilege escalation and potential container-to-host escape under affected configurations [2].

WHAT ARE THE VULNERABILITIES:

CVE-2026-64564 is a use-after-free vulnerability in the Linux kernel's SCTP implementation. A local, unprivileged attacker may be able to exploit the flaw to gain root privileges on the host when the vulnerable SCTP functionality is available.

IMPACTED VERSIONS:

According to the Linux kernel CVE announcement, the issue has been fixed in the following upstream kernel releases:

6.6.148 6.12.101 6.18.42 7.1.6 7.2-rc5 and later

Vendor kernels may include the fix through backported patches while retaining older kernel version numbers.

At the time of writing, Red Hat has not yet published a security advisory or CVE page for CVE-2026-64564. Because the vulnerability resides in the Linux kernel's SCTP implementation, practical exposure depends on whether SCTP support is available and enabled. On many RHEL/CentOS Stream 9 systems, the SCTP module is typically provided by the optional kernel-modules-extra package, which is not installed by default. Administrators should verify whether the sctp module is present or loaded on their systems.

Researchers demonstrated exploitation on:

Debian 13 (6.12.95) Ubuntu 24.04 (6.8.0-134) Rocky Linux 9 / RHEL 9-family systems running the vendor 5.14 kernel with the SCTP module loaded.

MITIGATION

Apply the vendor-provided kernel update when it becomes available for your platform. If SCTP is not required in your environment, consider disabling the sctp kernel module [4] as a temporary defense-in-depth measure: If currently loaded: modprobe -r sctp Prevent future loading: cat >/etc/modprobe.d/blacklist-sctp.conf <<EOF blacklist sctp install sctp /bin/false EOF Verify: modprobe -n -v sctp Expected output: install /bin/false If the module cannot be unloaded because it is in use, a reboot may be required after applying the blacklist.

WHAT YOU SHOULD DO:

Determine whether your systems have the sctp kernel module installed and/or loaded. If SCTP is not required, consider blacklisting the module until patched kernels are deployed. Apply the appropriate vendor kernel updates as they become available.

REFERENCES

[1] https://www.openwall.com/lists/oss-security/2026/08/06/3
[2] https://matrix.tencent.com/en/2026/08/06/sctphantom-CVE-2026-64564
[3] https://nvd.nist.gov/vuln/detail/CVE-2026-64564
[4] https://access.redhat.com/solutions/41278
[5] https://security-tracker.debian.org/tracker/CVE-2026-64564