A SCTP protocol vulnerability, proposed in the Linux kernel, has been identified (CVE-2026-64564) that allows a local user to gain root privileges in the system. Among other things, the vulnerability allows root access to the main system when the exploit is run in an isolated container. A prototype of the exploit has been prepared and demonstrated in the Debian 13, Rocky Linux 9, RHEL 9, and Ubuntu 24.04 distributions with kernels 5.14, 6.6, 6.8, and 6.12.
The vulnerability is caused by accessing already freed memory in the dynamic address reconfiguration code of SCTP (ASCONF). The kernel caches a pointer to the transport (asconf->transport) specified in the packet, but the memory associated with this pointer can be cleared, while the pointer to the already freed memory continues to be used during the processing of other commands. The attack is carried out by sending a specific sequence of ASCONF reconfiguration commands to a local socket: first, a DEL-IP packet is sent to remove the transport for a specific IP, followed by a DEL-IP packet indicating a mask of 0.0.0.0, whose processing will lead to the reuse of the remaining dangling pointer.
The vulnerability is due to a mistake made 18 years ago in kernel 2.6.25 (2008) and fixed in the releases 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5. The status of vulnerabilities fix in the distributions can be assessed on the following pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, Fedora.
Forrás: opennet.ru
