18‑Year‑Old Linux SCTP Use‑After‑Free Vulnerability Enables Root Escalation and Container Escape
What Happened — Researchers at Tencent disclosed a use‑after‑free bug in the Linux kernel’s SCTP networking stack that can be chained to obtain full root privileges on the host and break out of an unprivileged container. The flaw has existed since 2008 and was patched in the latest stable kernel releases (7.1.6, 6.18.42, 6.12.101, 6.6.148) on 3 August 2026. Systems running older kernels with SCTP enabled remain exploitable.
Why It Matters for Compliance & Audit Readiness
- The scenario maps directly to SOC 2 CC6.1 (system operations) and CC7.1 (change management): organizations must demonstrate that critical OS patches are applied promptly and that container isolation controls are continuously verified.
- Continuous‑compliance platforms can capture patch‑management evidence and container‑runtime hardening metrics, providing a defensible audit trail if a regulator questions the root‑cause of a breach.
Who Is Affected — Cloud‑infrastructure providers, SaaS platforms, telecom operators, and any organization that runs Linux containers or enables SCTP on production workloads.
Recommended Actions
- Verify kernel version on all Linux hosts; upgrade to a patched kernel (≥ 7.1.6, 6.18.42, 6.12.101, 6.6.148) immediately.
- If SCTP is not required, disable the protocol at the host and container level to reduce attack surface.
- Map the patch‑management process to SOC 2 control CC7.1, capture upgrade logs, and feed them into your continuous‑evidence repository.
Technical Notes — The vulnerability is a classic use‑after‑free (UAF) in net/sctp/ that can be triggered by crafted SCTP packets, leading to arbitrary code execution. No CVE number was disclosed at time of writing; the fix is included in the kernel releases listed above. Source: The Hacker News