In brief: A use-after-free flaw in the Linux SCTP code that has existed since 2008 allows root access and container escapes, and was only fixed on August 3 with kernel versions 7.1.6, 6.18.42, 6.12.101 and 6.6.148.
Researchers from Tencent exploited a use-after-free vulnerability that has existed since 2008 in the SCTP networking code of the Linux kernel to gain full root access on the underlying host from within a container. All systems on which SCTP is reachable and an unpatched kernel is running are affected.
The vulnerability lies in the Linux kernel’s SCTP (Stream Control Transmission Protocol) implementation and, according to reports, has existed since 2008. It is a use-after-free error that can be exploited by local attackers to reference memory again after it has been freed, thereby executing code with elevated privileges. Tencent security researchers demonstrated that the bug is suitable not only for local privilege escalation to root, but also for breaking out of a Linux container onto the host system.
For CISOs, the container escape aspect is the crucial point: in containerized environments — such as Kubernetes clusters or multi-tenant platforms — the kernel is considered a shared attack surface between multiple workloads or tenants. A vulnerability that undermines the isolation mechanism of containers thereby erodes a core security promise of this architecture. Since the flaw has already been present in the kernel for 18 years, it must be assumed that a large number of production systems with older kernel versions are affected, regardless of whether SCTP is actively used or the protocol is merely loaded as a kernel module and remains reachable.
A fix has already been released: the stable kernel versions 7.1.6, 6.18.42, 6.12.101 and 6.6.148 close the gap and have been available since August 3. Operators should check which kernel version is in use in their infrastructure — particularly on container hosts, cloud instances and bare-metal servers — and update to one of the versions mentioned or a newer one. Where prompt patching is not possible, it is recommended as an interim measure to disable the SCTP kernel module or restrict its reachability via firewall rules, provided SCTP is not required in one’s own operations.
Source: thehackernews.com · Published August 7, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.