CVE-2026-64564 — SCTPhantom: Linux SCTP ASCONF DEL-IP UAF (Local Privilege Escalation)

HackSpeak distribution repository. This repository is a distribution mirror of a community-public PoC; the code is identical to upstream.

⚠️ Upstream provides no LICENSE and no author information; this PoC is community-public code and has not been verified on real hardware — please check the upstream repository first for the latest version and any follow-up notes before deciding whether to use it; per distribution convention, this mirror uses the MIT License, Copyright (c) 2026 HackSpeak, and source copyright belongs to the original code author. Test only in a disposable environment; do not use against unauthorized systems.

Vulnerability Summary

A Use-After-Free caused by an identity mismatch in the Linux kernel SCTP subsystem's dynamic address reconfiguration (ASCONF) DEL-IP handling logic: the kernel validates the delete request using the packet source address, but acts on the transport selected by the ASCONF Address Parameter; by crafting the sequence [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0], the transport can be freed while the association still retains dangling pointers (primary_path / active_path), and subsequent socket operations trigger the UAF.

• CVE: CVE-2026-64564 (SCTPhantom)
• Impact: Local privilege escalation to root; can be extended to container-to-host escape
• Existed for: Since Linux 2.6.25 (commit 42e30bf3463c, around 2008), approximately 18 years
• Fix: Upstream commit 9b2854f86f0b; stable kernels 7.1.6 / 6.18.42 / 6.12.101 / 6.6.148 (released 2026-08-03)

Environment and Usage

• Target: Debian 13, kernel 6.12.95 (BTF-verified struct offsets; other kernels require adapting the offsets yourself)
• Dependencies: The SCTP module must be loadable/usable; the original version requires net.sctp.addip_enable and net.sctp.addip_noauth_enable (newer versions can bypass this via per-socket options)

gcc -O2 -static -o lpe lpe_debian.6.12.95.c
./lpe

Verification on success: read /etc/shadow or write the marker file /root/SCTP_LPE_SUCCESS.

Exploitation Chain (corresponding to the official technical analysis)

UAF #1 被 PACKET_TX_RING 的 pg_vec 回收 → direct-map 页面泄露 → 可重复 4 字节内核读 → 经固定 IDT 映射恢复 KASLR → UAF #2 被受控 SCTP authentication-key 数据回收 → 受控内核对象图 → 数据导向 commit_creds() → 全局 root → usermode-helper 变体 → 容器到宿主机逃逸。

Disclaimer

• For security research, vulnerability verification, and authorized testing only; run in a disposable environment (VM/container), and do not use against unauthorized systems.
• This PoC is community-public code and has not been verified on real hardware; exploitation corrupts the kernel object graph, and failure may cause a kernel crash.
• The distribution repository follows the MIT convention for upstreams without a LICENSE; copyright attribution is as above.

Reference Links

• Upstream source repository (source of this PoC, community code, not verified on real hardware): https://github.com/ethanolgolf/CVE-2026-64564
• The Hacker News report: https://thehackernews.com/2026/08/18-year-old-linux-sctp-flaw-could-let.html
• NVD: CVE-2026-64564 — https://nvd.nist.gov/vuln/detail/CVE-2026-64564 (as of 2026-08-07, NVD has not scored it)
• Upstream fix commit: 9b2854f86f0b (net/sctp/sm_make_chunk.c)
• Vulnerability introduction commit: 42e30bf3463c (completed in Linux 2.6.25)