18‑Year‑Old Linux SCTP Use‑After‑Free Lets Containers Escape to Host
An unpatched use‑after‑free in the SCTP stack, present since Linux 2.6.25 (2008), can be chained into full root and used to break out of a container into the host. Tencent’s Corvus AI team demonstrated the exploit and the fix is back‑ported to kernels 6.6.148, 6.12.101, 6.18.42 and 7.1.6.