CVE-2026-64564 — SCTPhantom:Linux SCTP ASCONF DEL-IP UAF(Local Privilege Escalation)

HackSpeak distribution repository. The original PoC comes from the community repository (upstream): github.com/ethanolgolf/CVE-2026-64564 — this repository is a mirror for convenient "backend reply" distribution, with code identical to upstream.

⚠️ Upstream ships no LICENSE and provides no author information; this PoC is community-published code that has not been verified on real hardware — please check the upstream repository first for the latest version and any subsequent notes before deciding whether to use it; following distribution convention, the mirror uses MIT License, Copyright (c) 2026 HackSpeak, with source code copyright belonging to the original code author. Test only in a disposable environment; do not use against unauthorized systems.

Vulnerability Summary

Use-After-Free caused by an identity mismatch in the DEL-IP handling logic of the Linux kernel SCTP subsystem's dynamic address reconfiguration (ASCONF): the kernel validates the deletion request against the packet's source address, but acts on the transport selected by the ASCONF Address Parameter; by crafting the [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] sequence, the transport can be freed while the association still retains dangling pointers (primary_path / active_path), and subsequent socket operations trigger the UAF.

• CVE:CVE-2026-64564(SCTPhantom)
• Impact: local privilege escalation to root; can be extended to container-to-host escape
• Present since: Linux 2.6.25 (commit 42e30bf3463c, around 2008) — approximately 18 years
• Fix: upstream commit 9b2854f86f0b; stable kernels 7.1.6 / 6.18.42 / 6.12.101 / 6.6.148 (released 2026-08-03)

Environment and Usage

• Target: Debian 13, kernel 6.12.95 (struct offsets verified via BTF; other kernels require adapting the offsets accordingly)
• Dependencies: requires a loadable/usable SCTP module; the original version requires net.sctp.addip_enable and net.sctp.addip_noauth_enable (newer versions can bypass this via per-socket options)

gcc -O2 -static -o lpe lpe_debian.6.12.95.c
./lpe

Verification on success: read /etc/shadow or write the marker file /root/SCTP_LPE_SUCCESS.

Exploit Chain (corresponding to official technical analysis)

UAF #1 is reclaimed by PACKET_TX_RING's pg_vec → direct-map page leak → repeatable 4-byte kernel read → KASLR recovery via the fixed IDT mapping → UAF #2 is reclaimed by controlled SCTP authentication-key data → controlled kernel object graph → data-oriented commit_creds() → global root → usermode-helper variant → container-to-host escape.

Disclaimer

• For security research, vulnerability validation, and authorized testing only; run it in a disposable environment (VM/container); do not use it against unauthorized systems.
• This PoC is community-published code not verified on real hardware; exploitation corrupts the kernel object graph, and failure may cause a kernel crash.
• The distribution repository follows the MIT convention for upstream code without a LICENSE; copyright attribution is as stated above.

References

• Fix commit: 9b2854f86f0b (net/sctp/sm_make_chunk.c)
• CVE-2026-64564 (NVD identifier; as of 2026-08-07 NVD has not yet assigned a score; defer to the official source)