Published on: 11 August 2026
Published on: 11 August 2026
Multiple elevation of privilege vulnerabilities ("Zapscape" and "SCTPhantom") are found in the Linux Kernel. For the Zapscape, this vulnerability could allow an attacker with root access inside a vulnerable guest VM to exploit KVM’s use-after-free flaw to escape the VM and gain root access to the host. For the SCTPhantom, this vulnerability could allow a low-privileged local attacker to exploit a use-after-free flaw in the Linux SCTP implementation to gain root privileges and potentially escape a vulnerable container to access the host.
Reports indicated that proof-of-concept (PoC) exploit code for an elevation of privilege vulnerability (Zapscape, CVE-2026-64561) is publicly available and it is at high risk of exploitation. System administrators are advised to take immediate action to patch your affected systems to mitigate the elevated risk of cyber attacks.
Zapscape, CVE-2026-64561
SCTPhantom, CVE-2026-64564
Successful exploitation of the vulnerabilities could lead to elevation of privilege or security restriction bypass on an affected system.
The vulnerabilities are fixed in some of the affected Linux distributions including Debian, Red Hat, SUSE and Ubuntu. The following is only a sample list of Linux distributions that are affected. The list is not exhaustive and it is strongly recommended to consult the product vendors if the used Linux systems are affected. System administrators should check with their product vendors to confirm if their Linux systems are affected and the availability of patches, and if so, apply the patches or follow the recommendations provided by the product vendors to mitigate the risk.