The flaw allows attackers to escalate from unprivileged local access to full root on the host by manipulating how SCTP ASCONF chunks are processed.

Exploitation hinges on the kernel’s handling of ASCONF chunks defined by RFC 5061, which govern dynamic path reconfiguration for SCTP associations.

Public exposure outside Tencent is limited; no widely published exploit code or CVE exploitation entry had appeared publicly as of the article date.

A use-after-free vulnerability in the kernel’s SCTP Dynamic Address Reconfiguration (ASCONF) feature enables privilege escalation and possible container escapes, under the tracker CVE-2026-64564 (SCTPhantom).

Mitigation details were not fully disclosed in the excerpt, but fixes typically involve patching the kernel, updating to fixed versions, and applying vendor advisories.

Backporting fixes may occur without upgrading upstream versions, and related SCTP use-after-free issues were addressed after the August 3 releases.

Tencent demonstrated root on six of eight tested builds without requiring CAP_NET_ADMIN or CAP_SYS_ADMIN, using default seccomp profiles.

Root cause traces to code introduced in Linux 2.6.25 in December 2007, marking an almost 18-year-old issue before discovery.

Mitigation guidance includes blocking the SCTP module if not needed, verifying kernel version/patch status, and confirming coverage with distribution trackers; assess whether net.sctp is required in the environment.

The article underscores the severity and historical nature of the bug, stressing the urgency of timely patching and monitoring for CVE-2026-64564 updates.

Severity remains unsettled; Tencent rated it 8.5/10 on CVSS v4.0, while NVD had not assigned a score at publication.

Technical flaw involves a mismatch where a delete request is checked against one address but acts on another path address in the same message, enabling use-after-free and memory pointer eviction.