A use-after-free vulnerability in Linux's SCTP (Stream Control Transmission Protocol) networking subsystem presents a direct path to root privilege escalation and container escape. Researchers at Tencent discovered the flaw persists since 2008 without detection, making it an 18-year-old attack surface.
The bug allows local users with SCTP access to trigger memory corruption that yields full root access on the underlying host system. More critically, Tencent demonstrated successful container escape, meaning attackers inside containerized environments can break out and compromise the physical or virtual machine running the container infrastructure.
Linux kernel maintainers patched the vulnerability in stable releases 7.1.6, 6.18.42, 6.12.101, and 6.6.148, all released August 3. Systems running older kernels with SCTP enabled remain vulnerable.
The risk profile splits into two layers. First, organizations running containerized workloads face the highest exposure. A compromised container becomes an escalation point to the entire host system, potentially giving attackers access to all other containers, sensitive data, and network resources. Second, non-containerized Linux systems with SCTP enabled and local user access remain vulnerable to straightforward privilege escalation.
SCTP carries lower adoption than TCP or UDP in most enterprise environments, but it appears in telecommunications infrastructure, certain database replication systems, and specialized networking applications. The long dormancy of this flaw underscores how older protocol implementations can harbor undiscovered vulnerabilities for years.
Immediate action requires identifying systems running vulnerable kernels, particularly those exposed to untrusted local users or running container orchestration platforms. Organizations should prioritize container hosts and systems with SCTP explicitly enabled. The patches are stable and widely tested, reducing deployment friction.
The 18-year window demonstrates the security principle that obscurity provides