Linux Kernel — SCTPhantom: SCTP ASCONF DEL-IP Use-After-Free Local Privilege Escalation (CVE-2026-64564)

CVE-2026-64564 is a use-after-free vulnerability in the Linux kernel SCTP ASCONF DEL-IP processing. When a multihomed SCTP association processes an ASCONF chunk that deletes an IP address, the associated transport structure is freed but a dangling pointer remains accessible through the association. The exploit reclaims the freed transport with controlled data via PACKET_TX_RING pages and SCTP auth key sprays, builds a fake credential/transport/association object graph in controlled pages, and triggers commit_creds() with a forged init_cred to escalate to global root.

The exploit implements a two-stage UAF approach: UAF #1 leaks a controlled direct-map page address through the freed transport’s status fields, and UAF #2 reclaims the active_path transport pointer with a self-consistent fake object graph that redirects SCTP’s routing path to call commit_creds(init_cred).

Root Cause

The SCTP ASCONF (Address Configuration Change) extension allows dynamic addition and removal of IP addresses from associations. When processing an ASCONF DEL-IP chunk, the kernel frees the sctp_transport structure for the deleted address. However, the association’s active_path or primary_path pointer may still reference the freed transport. Subsequent operations on the association (status queries, send, close) dereference the dangling pointer.

Exploitation Process

1. Namespace setup: Creates user/network namespaces with SCTP ASCONF enabled.
2. Multihomed association: Establishes a multihomed SCTP association with multiple bound addresses.
3. UAF #1 – Page leak: Sends a crafted ASCONF DEL-IP chunk via raw socket to free a transport, then reclaims it with PACKET_TX_RING pages. Reads the leaked page address via getsockopt(SCTP_STATUS) which returns the reclaimed transport’s spinfo_srtt and spinfo_cwnd fields (overlapping the controlled page data).
4. Fake object graph: Populates the leaked controlled page with a complete fake transport/association/credential graph, including forged function pointers to commit_creds and the init credential addresses.
5. KASLR bypass: Reads the fixed IDT mapping at 0xfffffe0000000000 via a 32-bit arbitrary read primitive (redirecting association ID reads through reclaimed transports) to recover the kernel ASLR slide.
6. UAF #2 – Credential overwrite: Frees another transport, reclaims it with the fake object graph via SCTP auth key spray, and triggers commit_creds(init_cred) through the forged function pointer chain when the association is closed.
7. Verification: Reads /etc/shadow to confirm global root credentials.

Impact

Local privilege escalation from unprivileged user to global root. Verified on Debian 13 with kernel 6.12.95. The exploit reads /etc/shadow as proof and writes a marker file to /root/.

See lpe_debian.6.12.95.c (842 lines, C) in this folder – mirrored byte-for-byte from HackSpeak/CVE-2026-64564. The upstream README is preserved as upstream-README.md.

Step-by-Step Reproduction

1. Build: gcc -O2 -static -o lpe lpe_debian.6.12.95.c
2. Run as unprivileged user: ./lpe
3. Observe: The exploit creates namespaces, establishes SCTP associations, triggers the UAF, leaks KASLR slide, builds fake objects, and escalates to root.
4. Verify: /etc/shadow contents printed, /root/SCTP_LPE_SUCCESS marker created.

Exploit Code

ASCONF DEL-IP chunk construction:

1
2
3
4
5
6
7
8
9

static int asconf(uint8_t *pk, uint32_t vt, uint32_t serial) {
    // ...
    *p++ = CHUNK_ASCONF; *p++ = 0; p += 2;
    p = p32(p, htonl(serial));
    p = p16(p, PARAM_IPV4); p = p16(p, 8);
    p = p32(p, htonl(L));
    p = p16(p, PARAM_DEL_IP); p = p16(p, 16);
    // ...
}

Root verification:

1
2
3
4
5
6

if (after && !before) {
    print_line("+", "global root confirmed");
    char buf[128]; int fd = open("/etc/shadow", O_RDONLY);
    int n = (fd >= 0) ? read(fd, buf, 80) : -1;
    // ...
}

Expected Output

[+] UAF1 page: 0xffff888012345000 (3 attempts)
[*] victims ready: 48/48
[+] KASLR slide: 0x1a200000 (IDT 0x1234)
[+] credential security: 0xffffffff82c53940
[+] association: 0xffff888023456000 (1 attempts)
[+] double reclaim transport: 0xffff888034567000
[+] double reclaim: landed=1 attempts=2 status=0x1337beef state=3
[*] trigger: sprayed=6000 uid=1000 before=0
[+] global root confirmed
[+] shadow: root:!:19000::::::
[+] marker written: /root/SCTP_LPE_SUCCESS

• NVD – CVE-2026-64564
• HackSpeak/CVE-2026-64564 (upstream PoC)

Verified this session by reading the full exploit source (lpe_debian.6.12.95.c, 842 lines). The exploit is a single C file using standard Linux syscalls: socket/setsockopt for SCTP operations, AF_PACKET/PACKET_TX_RING for heap spray, raw sockets for crafted ASCONF chunks, and mmap for controlled page access. All kernel symbol addresses are hardcoded for Debian 13 kernel 6.12.95.

Malware screen – clean. No obfuscation, no remote downloaders, no credential exfiltration beyond the local /etc/shadow read (which is the proof-of-concept verification), no miners, no C2 callbacks. The only persistent artifact is a marker file at /root/SCTP_LPE_SUCCESS. The process remains alive (via execv("/bin/sleep")) after exploitation to avoid unsafe teardown of dangling victim associations.

Author: HackSpeak, same account as CVE-2026-64531 (OVSwrap). Described as a “community PoC mirror” with 6 stars. The code is well-structured exploit research with detailed inline comments explaining each stage. Lower author confidence but code verified clean.