Eighteen-Year-Old Bug in Linux Networking Code Hands Attackers the Keys to the Machine
A flaw in Linux's SCTP networking that has been sitting in the code since 2008 lets a local user become root and break out of a container. Fixed kernels shipped on 3 August.
Key points
- A memory-handling bug in Linux's SCTP networking code, present since 2008, lets a local user gain full root control of the machine.
- Tencent researchers demonstrated using the flaw to escape a container and reach the underlying host.
- Fixed kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148 shipped on 3 August 2025.
- Any Linux system running an older kernel with SCTP reachable is exposed until patched.
- No public reports yet of criminal groups weaponising the bug in the wild.
A flaw that has been sitting quietly in the Linux kernel since 2008 turns out to be enough to hand an attacker complete control of the machine.
The bug lives in the code that handles SCTP, a networking protocol used mostly in telecoms and some enterprise systems to move data between computers. It's a use-after-free flaw, meaning the kernel keeps using a chunk of memory after it's already been freed for other purposes. Nudge the right data into that reused memory and you can rewrite what the kernel does next.
Researchers at Tencent worked out how to turn that into root, the top level of access on a Linux machine. Root can read any file, install anything and take down any service.
What did the researchers actually do?
They used the bug to break out of a container and take over the host underneath. A container is a sealed box that runs an app in isolation from the rest of the server, and cloud providers rely on that isolation to keep one customer's code from touching another's. Escaping one defeats that promise entirely.
The finding, first reported by The Hacker News, matters most to anyone running shared Linux infrastructure: cloud hosts and multi-tenant servers where untrusted code is allowed to run.
How old is this bug?
It was introduced in 2008. That's not a typo. The faulty code shipped in mainstream Linux kernels for the best part of two decades, unnoticed by maintainers and the many companies that audit kernel networking code.
This is the third Linux local-privilege flaw we've reported in a month: GhostLock on 8 July exploited a fifteen-year-old kernel bug, and RefluXFS on 23 July did the same with a nine-year-old one. Old code keeps delivering.
Is a fix available?
Yes. Stable Linux kernels 7.1.6, 6.18.42, 6.12.101 and 6.6.148 all shipped patches on 3 August 2025.
| Kernel branch | Fixed version | Released |
|---|---|---|
| 7.1 | 7.1.6 | 3 Aug 2025 |
| 6.18 | 6.18.42 | 3 Aug 2025 |
| 6.12 | 6.12.101 | 3 Aug 2025 |
| 6.6 | 6.6.148 | 3 Aug 2025 |
Most major Linux distributions pull stable kernel fixes into their own updates within days. Server administrators should check what their machines are running and apply the vendor update as soon as it lands.
Who needs to worry about this?
Anyone with a Linux machine where SCTP is reachable and where untrusted users or code can run. That covers cloud providers, telecoms operators and any shop running mixed workloads in containers on the same host. A desktop Linux user with no SCTP in play isn't the target audience here.
There's no sign yet that criminals have picked up the bug. That gap between disclosure and exploitation tends to close quickly, especially for flaws that hand over root.
Ordinary customers of cloud services don't need to do anything. Your provider patches the host; you don't see the kernel. Watch for maintenance notices from your cloud vendor and expect brief reboots on affected fleets over the coming days.
The real story isn't the age of the bug, it's the pattern. Three root-level Linux kernel flaws in five weeks suggests auditors are looking at old code with sharper tools. Expect more to surface.
