A use-after-free sat in the Linux kernel since 2008 — and an AI research pipeline is what finally found it

The bug is eighteen years old. It arrived in Linux 2.6.25 in 2008 and has been in every kernel since, which means it has shipped in essentially every Linux system running today.

CVE-2026-64564, called SCTPhantom by the people who found it, is a use-after-free in the kernel's SCTP networking code. Tencent scores it 8.5 under CVSS v4.0; NVD had not assigned a score as of 7 August 2026.

The logic error

SCTP lets one connection run across multiple network paths, and lets peers add or remove addresses mid-connection. That reconfiguration is where the flaw lives.

The kernel checks a delete request against the packet's source address, but then acts on a path it selected using a different address from inside the message. One message can add an address, delete it, then issue a wildcard delete — freeing the path and leaving the kernel using the dead pointer.

The two addresses are supposed to be the same. Nothing enforced that they were.

What it gets an attacker

Local privilege escalation to root, and container escape.

Tencent Zhuque Lab got root on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9 and OpenCloudOS. An early exploit needed particular sysctls enabled; a later version removed that requirement by using per-socket configuration instead.

The container result is the one to read twice. The escape test granted neither CAP_NET_ADMIN nor CAP_SYS_ADMIN — no elevated networking or admin capability — and reached host root in six of eight attempts.

Where it doesn't reach

Two limits are worth stating, because "18-year-old kernel flaw" invites panic.

SCTP has to be reachable. It is not a protocol most systems use, and where the module isn't loaded there is nothing to attack.

Exploitability varies with the sandbox. The openKylin advisory for the same bug reports only kernel panic and denial of service — not container escape. That is not a contradiction so much as evidence that container runtime, seccomp profile and user-namespace configuration materially change the outcome.

As of 7 August there was no public exploit code, and the flaw was not in CISA's KEV catalog.

Fixing it

The patch refuses deletes that target the message's own processing path. Fixed stable kernels, released 3 August: 7.1.6, 6.18.42, 6.12.101 and 6.6.148.

One trap: distributions routinely backport security fixes without bumping the version string, so a kernel that looks old may be patched and a kernel that looks new may not be. Check your distribution's tracker, not uname -r.

Where SCTP isn't needed — which is most places — blacklisting the module removes the attack surface outright and is the more durable answer than tracking the patch.

The part that isn't about SCTP

Tencent credits the discovery to Corvus AI, a multi-agent pipeline built for kernel research.

That is the detail with consequences beyond this CVE. Eighteen years of human review, fuzzing and audit did not surface this, and a machine pipeline did. The same economics that let an attacker run an intrusion unattended let a defender run code review unattended, and the dormant-bug backlog in old, complex, widely-deployed C is enormous.

Expect more findings like this — and expect the disclosure queue to feel the load.