18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers

Summary

A use-after-free bug in Linux's SCTP networking code can be turned into full root on a host, and Tencent researchers say they used it to escape a container and reach the machine underneath. The flaw has existed since 2008. The fix already shipped: stable kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148, released August 3, close it. Anyone running an older kernel with SCTP reachable should update.

Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.