SCTPhantom (CVE-2026-64564) is a local-only Linux kernel use-after-free that gives root and, in containers, reaches the host; public exploit code is out.
Red Hat blacklists SCTP by default, Canonical's denylist does not, and Tencent got root on Ubuntu 24.04, Debian 13 and Rocky 9 with SCTP loaded.
The public exploit needs CAP_NET_RAW, which Docker keeps by default, so dropping it is a cheap extra barrier.
Distribution kernels arrived through October 6, about nine weeks after the upstream fix, so block the sctp module if you cannot patch.