AI-Generated · xiaomi/mimo-v2.5-pro

A Use-After-Free Hid in the Linux Kernel's SCTP Code for 18 Years

CVE-2026-64564, an 18-year-old use-after-free in the Linux kernel's SCTP code found by Tencent's AI-assisted research pipeline, enables local privilege escalation and container escape — and Debian shipped a patch the same day it was disclosed.

linuxcybersecurity

— 3 mins read

An eighteen-year-old use-after-free in the Linux kernel’s Stream Control Transmission Protocol code was disclosed on August 6, 2026 — assigned, patched, and rolled into a same-day Debian kernel update within hours. CVE-2026-64564 carries a CVSS v4.0 score of 8.5 and allows a local low-privileged user to gain root and escape containers, according to the primary disclosure by Fourie Zhang of Tencent’s Zhuque Lab.

The vulnerability lives in the kernel’s SCTP Dynamic Address Reconfiguration (ASCONF) transport code and dates to Linux 2.6.25, released in 2008. That’s nearly two decades during which a use-after-free — the kind of memory corruption that has powered some of the most reliable local privilege escalation techniques in Linux history — sat in a code path most kernel developers and system administrators probably forgot existed. A second, distinct use-after-free involving a dangling transport reference in the same SCTP code was also patched on August 6.

What makes the disclosure unusual beyond its age is how it was found. Tencent’s lab credits Corvus AI, its multi-agent automated research pipeline, with uncovering the bug. In the lab’s testing, six of eight container-escape attempts reached host root. No public exploit code has surfaced, and no CISA KEV entry existed as of August 7 — but the lab’s success rate points to a vulnerability that is reliably exploitable once an attacker has local access.

The fix landed in kernels 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5, and was tested against Debian 13, Ubuntu 24.04, Rocky Linux 9, and RHEL 9. Debian moved fastest: the distribution shipped a kernel security update on August 6 itself, bringing the kernel to 6.12.101-1 and covering 28 flaws total including CVE-2026-64564. All Debian 13 users were urged to update immediately.

For most production environments, the practical question is whether SCTP is even loaded. On many distributions the module is not compiled in or loaded by default, which narrows the attack surface — but doesn’t eliminate it for systems where SCTP is in active use. Eighteen years is a long time for a vulnerability to sit in mainline kernel code, and that same longevity means it has had ample time to propagate into embedded systems, appliances, and long-lived server deployments that will not patch quickly or at all.

Sources