Answer Brief
GovCERT.HK has issued a High Threat Security Alert (A26-08-15) for two elevation-of-privilege vulnerabilities in the Linux kernel—Zapscape (CVE-2026-64561) and SCTPhantom (CVE-2026-64564)—with public PoC exploit code available for Zapscape, posing immediate risk of VM escape and host compromise.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
GovCERT.HK publishes High Threat Security Alert A26-08-15 on Zapscape and SCTPhantom vulnerabilities
- 2
Public PoC exploit code for Zapscape (CVE-2026-64561) reported as available and high risk of exploitation
Executive Summary: GovCERT.HK has issued a High Threat Security Alert (A26-08-15) for two elevation-of-privilege vulnerabilities in the Linux kernel—Zapscape (CVE-2026-64561) and SCTPhantom (CVE-2026-64564)—with public PoC exploit code available for Zapscape, posing immediate risk of VM escape and host compromise.
Why It Matters
GovCERT.HK’s High Threat Security Alert A26-08-15 highlights two critical elevation-of-privilege vulnerabilities in the Linux kernel—Zapscape (CVE-2026-64561) and SCTPhantom (CVE-2026-64564)—that pose significant risks to cloud infrastructure, virtualized environments, and containerized workloads. The Zapscape vulnerability stems from a use-after-free flaw in KVM’s handling of guest VMs, allowing an attacker who already has root access inside a vulnerable guest virtual machine to escape the VM boundary and gain root privileges on the host system. This type of VM escape is particularly severe in multi-tenant cloud environments where isolation between guest and host is a foundational security assumption. The SCTPhantom vulnerability, identified as CVE-2026-64564, involves a use-after-free flaw in the Linux Stream Control Transmission Protocol (SCTP) implementation. It enables a local attacker with low privileges to escalate to root access on the host and potentially break out of a compromised container to access the underlying host system. Both vulnerabilities affect a wide range of Linux kernel versions, spanning from as early as 2.6.25 for SCTPhantom and 5.9 for Zapscape, up through pre-release versions like 7.2-rc5, with specific point releases excluded where patches have been applied. The alert explicitly notes that public proof-of-concept exploit code for Zapscape is already available and assessed as being at high risk of active exploitation, which elevates the urgency for defensive action. This availability of exploit code increases the likelihood of rapid weaponization and integration into attack toolkits targeting inadequately patched systems. The affected kernel versions cover extensive deployments across enterprise Linux distributions, including long-term support (LTS) branches commonly used in data centers, cloud platforms, and container orchestration environments such as Kubernetes. Vendors including Debian, Red Hat, SUSE, and Ubuntu have confirmed that patches are available for both CVEs, and the alert provides direct links to their respective security trackers and advisories for validation. System administrators are strongly advised to consult their specific Linux distribution vendors to confirm whether their systems are affected and to obtain the correct patches, as the list of affected distributions provided in the alert is noted as non-exhaustive. The recommendation emphasizes patching as the primary mitigation, with no alternative workarounds mentioned in the source. From an operational perspective, these vulnerabilities underscore the importance of timely kernel patching in virtualized and containerized infrastructures, especially where privilege boundaries between guest, container, and host are critical to security posture. The fact that both flaws can be chained from relatively low initial access—such as a compromised container or guest VM—to full host compromise highlights the need for defense-in-depth strategies, including least-privilege access controls, runtime monitoring, and rapid patch deployment. For global security, AI, and cloud operations teams, this alert serves as a first-hand signal from Hong Kong’s GovCERT.HK, reflecting active threat monitoring and vulnerability disclosure practices in East Asia. While the vulnerabilities are not region-specific in impact, the early detection and public alerting by a regional CERT contribute valuable intelligence for global defenders seeking to prioritize patching and threat hunting efforts. Organizations should monitor for signs of exploitation attempts, particularly those involving privilege escalation sequences originating from guest VMs or containers, and validate that their Linux kernel versions are within supported, patched ranges. The absence of mention of specific threat actors, malware families, or targeted sectors in the source prevents attribution speculation, but the technical nature of the flaws suggests potential appeal to actors seeking stealthy host compromise in cloud or hybrid environments.
Event Type: security
Importance: high
Affected Companies
- Debian
- Red Hat
- SUSE
- Ubuntu
Affected Sectors
- cloud infrastructure
- container security
- operating systems
- virtualization
Key Numbers
- CVE-2026-64561 (Zapscape) affected kernel versions: 5.9 through 6.6.148, 6.7 through 6.12.101, 6.13 through 6.18.42, 6.19 through 7.1.6, 7.2 through 7.2-rc5 (excluding patched point releases)
- CVE-2026-64564 (SCTPhantom) affected kernel versions: 2.6.25 through 6.6.148, 6.7 through 6.12.101, 6.13 through 6.18.42, 6.19 through 7.1.6, 7.2 through 7.2-rc5 (excluding patched point releases)
Timeline
- GovCERT.HK publishes High Threat Security Alert A26-08-15 on Zapscape and SCTPhantom vulnerabilities
- Public PoC exploit code for Zapscape (CVE-2026-64561) reported as available and high risk of exploitation
Frequently Asked Questions
What are Zapscape and SCTPhantom in the Linux kernel?
Zapscape (CVE-2026-64561) is a use-after-free flaw in KVM allowing root access in a guest VM to escape to host root. SCTPhantom (CVE-2026-64564) is a use-after-free in the SCTP implementation enabling local low-privilege attackers to gain root and potentially escape containers.
Which Linux kernel versions are affected by Zapscape and SCTPhantom?
Zapscape affects versions 5.9–7.2-rc5, excluding patched point releases like 6.6.148, 6.12.101, etc. SCTPhantom affects a broader range from 2.6.25 through 7.2-rc5, excluding the same patched point releases.
Is there public exploit code for these vulnerabilities?
Yes, proof-of-concept (PoC) exploit code for Zapscape (CVE-2026-64561) is publicly available and assessed as high risk of exploitation by GovCERT.HK.
Which Linux distributions have patches available for these CVEs?
Debian, Red Hat, SUSE, and Ubuntu have released patches for both CVE-2026-64561 and CVE-2026-64564, as referenced in their respective security trackers and advisories.
What should system administrators do in response to this alert?
Administrators should immediately check with their Linux distribution vendors to confirm patch availability and apply updates for affected kernel versions to mitigate privilege escalation and VM/container escape risks.