{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/linux-kernel-6.12.95/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-64564"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Linux kernel (6.12.95)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eCVE-2026-64564 is a high-severity Use-After-Free (UAF) vulnerability discovered in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem. The flaw is triggered when the kernel processes a malformed \u003ccode\u003eASCONF\u003c/code\u003e (Address Configuration) chunk containing \u003ccode\u003eDEL-IP\u003c/code\u003e (Delete IP Address) parameters. This action causes the kernel to improperly free the \u003ccode\u003estruct sctp_transport\u003c/code\u003e memory object while retaining a dangling pointer to it.\u003c/p\u003e\n\u003cp\u003eThe vulnerability affects various Linux kernel versions, including 6.12.95, and has been addressed in upstream kernel versions 6.12.101 and 6.6.148. A Proof of Concept (PoC) titled \u0026quot;SCTPhantom\u0026quot; is publicly available, detailing how an attacker can leverage this UAF condition to perform a heap spray, bypass Kernel Address Space Layout Randomization (KASLR), and corrupt the \u003ccode\u003estruct cred\u003c/code\u003e of a process to escalate privileges to root. Due to the requirement for hardcoded kernel offsets in the available PoC, exploitation currently requires specific knowledge of the target kernel build.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker verifies that the SCTP module is loaded on the target Linux system via \u003ccode\u003elsmod\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes a valid SCTP association by running an auxiliary listener process on the victim host or an external peer.\u003c/li\u003e\n\u003cli\u003eThe attacker executes the exploit binary as a non-privileged user to trigger the SCTP \u003ccode\u003eASCONF\u003c/code\u003e command.\u003c/li\u003e\n\u003cli\u003eThe malformed \u003ccode\u003eASCONF\u003c/code\u003e chunk containing \u003ccode\u003eDEL-IP\u003c/code\u003e is processed, resulting in the premature freeing of \u003ccode\u003estruct sctp_transport\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe attacker executes a heap spray to reclaim the freed memory region with attacker-controlled data.\u003c/li\u003e\n\u003cli\u003eThe attacker leaks kernel addresses via the dangling pointer to calculate and bypass KASLR offsets.\u003c/li\u003e\n\u003cli\u003eThe attacker overwrites the target process's \u003ccode\u003estruct cred\u003c/code\u003e by manipulating the corrupted kernel memory.\u003c/li\u003e\n\u003cli\u003eThe exploit invokes \u003ccode\u003ecommit_creds()\u003c/code\u003e to escalate the process privileges to root and spawns an interactive shell.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-64564 results in total local privilege escalation on vulnerable Linux systems. An attacker with standard user access can gain full root control, enabling unauthorized access to sensitive files like \u003ccode\u003e/etc/shadow\u003c/code\u003e, installation of persistent backdoors, and complete compromise of system integrity. The vulnerability affects any distribution running unpatched kernel versions, with significant risk posed to servers and multi-user environments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all Linux systems to kernels 6.12.101, 6.6.148, or later, which contain the official fix for CVE-2026-64564.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediately feasible, disable the SCTP module on production systems by running \u003ccode\u003esudo modprobe -r sctp\u003c/code\u003e and adding it to a blacklist configuration file.\u003c/li\u003e\n\u003cli\u003eImplement system-wide kernel hardening and monitor for unusual loading of the \u003ccode\u003esctp\u003c/code\u003e kernel module on systems where it is not required for business operations.\u003c/li\u003e\n\u003cli\u003eDeploy kernel integrity monitoring to detect anomalous memory modifications consistent with UAF heap spraying.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-19T13:36:43Z","date_published":"2026-08-19T13:36:43Z","id":"https://feed.craftedsignal.io/briefs/2026-08-sctp-uaf-lpe/","summary":"A Use-After-Free vulnerability in the Linux kernel SCTP subsystem (CVE-2026-64564) allows local unprivileged users to escalate privileges to root through malicious ASCONF chunk processing.","title":"Linux Kernel SCTP Use-After-Free Vulnerability (CVE-2026-64564)","url":"https://feed.craftedsignal.io/briefs/2026-08-sctp-uaf-lpe/"}],"language":"en","title":"CraftedSignal Threat Feed - Linux Kernel (6.12.95)","version":"https://jsonfeed.org/version/1.1"}