Linux kernel vulnerabilities Zapscape and SCTPhantom enable host escape

Two significant vulnerabilities have been disclosed in the Linux kernel that could allow attackers to escape isolation and gain host-level control.

One vulnerability, named Zapscape (CVE-2026-64561), affects the Kernel-based Virtual Machine (KVM) hypervisor. Disclosed by researcher Hyunwoo Kim, the flaw exists in the shadow memory management unit for x86 architectures. It stems from a stale-root check ordering flaw, which creates a use-after-free condition. This could allow an attacker with kernel privileges inside a guest virtual machine to execute code directly on the host system.

A second vulnerability, identified as SCTPhantom (CVE-2026-64564), was disclosed by Tencent Zhuque Lab. Located within the Stream Control Transmission Protocol (SCTP) functionality, this flaw has existed for approximately 18 years. It involves a logic error in how the kernel handles address change requests, leading to a use-after-free vulnerability. This flaw can allow low-privilege local programs to escalate to highest system permissions and can potentially bypass container isolation to control the host.

Patches have been released for the SCTPhantom vulnerability in several kernel versions, including 6.6.148, 6.12.101, and 7.1.6.