A vulnerability (CVE-2026-64564) has been identified in the SCTP protocol implementation proposed in the Linux kernel, allowing a local user to gain root privileges on the system. Among other things, this vulnerability permits root access in the primary system when the exploit is launched in an isolated container. An exploit prototype has been prepared, demonstrated in Debian 13, Rocky Linux 9, RHEL 9, and Ubuntu 24.04 with kernels 5.14, 6.6, 6.8, and 6.12.
The vulnerability is caused by accessing already freed memory in the dynamic address reconfiguration code for SCTP (ASCONF). The kernel caches a pointer to the transport (asconf->transport) specified in the packet, but the memory associated with this pointer may be freed, while the pointer itself continues to be used for processing other commands. The attack is carried out by sending a specific sequence of ASCONF address reconfiguration commands to a local socket: first, a DEL-IP packet is sent to remove transport for a specific IP, followed by a DEL-IP packet with the mask 0.0.0.0, the processing of which will lead to the reuse of the remaining dangling pointer.
The vulnerability stems from an error made 18 years ago in kernel 2.6.25 (2008) and was fixed in releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. The status of vulnerability remediation in the distributions can be assessed on these pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, Fedora.
Source: opennet.ru
