A critical use-after-free vulnerability in the Linux kernel SCTP implementation, dubbed SCTPhantom, permits unprivileged local attackers to achieve root-level privileges and potentially escape containerized environments.

This is a use-after-free vulnerability located within the Stream Control Transmission Protocol (SCTP) dynamic address reconfiguration logic. The flaw allows an attacker to interact with a freed transport object during DEL-IP processing, which can be triggered by a local user, including those within constrained environments like containers.

The CVSS score of 9.8 reflects the extreme severity of this flaw, as it enables full system compromise through local privilege escalation. Successful exploitation results in an attacker gaining root access, which facilitates data exfiltration, persistent malware installation, and the compromise of containerized workloads, potentially impacting the entire host infrastructure.

Immediate Action: Update the Linux kernel to version 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 as provided by your distribution vendor.

Proactive Monitoring: Monitor system logs for unexpected kernel crashes, segmentation faults related to the sctp module, or suspicious attempts to load the sctp kernel module.

Compensating Controls: If immediate patching is not feasible, restrict the ability of unprivileged users to load the sctp kernel module using modprobe blacklisting (e.g., install sctp /bin/true in modprobe.d).

Public Exploit Available: Yes, multiple public proofs-of-concept are available on GitHub and other security research repositories.

Given the critical severity of this vulnerability and the availability of public exploit code, organizations must prioritize patching the kernel across all affected environments, including container hosts. System administrators should verify kernel versions immediately and apply the stable updates provided by their respective distributions to prevent unauthorized root-level access.