In the SCTP protocol implementation provided in the kernel LinuxA vulnerability (CVE-2026-64564) has been identified that allows a local user to gain root privileges on the system. Among other things, the vulnerability allows root access to the host system when running an exploit in an isolated container. A prototype exploit has been developed and demonstrated in distributions. Debian 13 Rocky Linux 9, RHEL 9 and Ubuntu 24.04 with kernels 5.14, 6.6, 6.8 and 6.12.
The vulnerability is caused by a reference to already-freed memory in the SCTP dynamic address reconfiguration (ASCONF) code. The kernel caches a transport pointer (asconf->transport) specified in a packet, but the memory associated with this pointer can be cleared, while the pointer to the now-freed memory itself continues to be used for processing other commands. The attack is carried out by sending a specific sequence of ASCONF address reconfiguration commands to a local socket: first, a DEL-IP packet is sent to delete the transport for a specific IP address, followed by a DEL-IP packet specifying a mask of 0.0.0.0. Processing this packet will result in the reuse of the remaining dangling pointer.
The vulnerability is caused by a bug introduced 18 years ago in kernel 2.6.25 (2008) and fixed in releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. The status of vulnerability fixes in distributions can be assessed on these pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, Fedora.
Source: opennet.ru
