Linux Kernel SCTP ASCONF DEL-IP Use-After-Free (SCTPhantom)

#!/bin/bash
# CVE-2026-64564 (SCTPhantom) — SCTP ASCONF DEL-IP UAF Checker
# Target: Linux hosts | Privileges: root recommended | Exit: 0=PATCHED 1=VULNERABLE 2=MITIGATED 3=UNKNOWN
set -uo pipefail

KERNEL="$(uname -r)"
echo "[*] Kernel: $KERNEL"

# Extract numeric version (handles distro suffixes like 5.15.0-123-generic)
KVER="$(echo "$KERNEL" | grep -oE '^[0-9]+\.[0-9]+\.[0-9]+')"
if [ -z "$KVER" ]; then
  echo "UNKNOWN — could not parse kernel version."
  exit 3
fi

MAJOR=$(echo "$KVER" | cut -d. -f1)
MINOR=$(echo "$KVER" | cut -d. -f2)
PATCH=$(echo "$KVER" | cut -d. -f3)

echo "[*] Parsed version: $MAJOR.$MINOR.$PATCH"

# --- Version check against upstream fix points ---
# Fixed in: 6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc5+
# Vulnerable from: 2.6.25 onward
vuln=1

if [ "$MAJOR" -ge 8 ]; then
  vuln=0
elif [ "$MAJOR" -eq 7 ]; then
  if [ "$MINOR" -ge 2 ]; then
    vuln=0  # 7.2-rc5+ contains fix
  elif [ "$MINOR" -eq 1 ] && [ "$PATCH" -ge 6 ]; then
    vuln=0  # 7.1.6
  fi
elif [ "$MAJOR" -eq 6 ]; then
  if [ "$MINOR" -gt 18 ]; then
    vuln=0
  elif [ "$MINOR" -eq 18 ] && [ "$PATCH" -ge 42 ]; then
    vuln=0
  elif [ "$MINOR" -gt 12 ] && [ "$MINOR" -lt 18 ]; then
    vuln=1  # 6.13-6.17 — no backport branch listed, assume vulnerable
  elif [ "$MINOR" -eq 12 ] && [ "$PATCH" -ge 101 ]; then
    vuln=0
  elif [ "$MINOR" -gt 6 ] && [ "$MINOR" -lt 12 ]; then
    vuln=1
  elif [ "$MINOR" -eq 6 ] && [ "$PATCH" -ge 148 ]; then
    vuln=0
  fi
elif [ "$MAJOR" -lt 2 ]; then
  vuln=0
elif [ "$MAJOR" -eq 2 ] && [ "$MINOR" -lt 6 ]; then
  vuln=0
elif [ "$MAJOR" -eq 2 ] && [ "$MINOR" -eq 6 ] && [ "$PATCH" -lt 25 ]; then
  vuln=0
fi

if [ "$vuln" -eq 0 ]; then
  echo "[+] Kernel version is at or above a fix level."
  echo ""
  echo "PATCHED"
  exit 0
fi

echo "[!] Kernel version $KVER is in the vulnerable range."
echo "    NOTE: Distro backport patches (RHSA/DSA/USN) may have fixed"
echo "    this without changing the version string. Cross-check with"
echo "    your package manager (rpm -q kernel / dpkg -l linux-image-*)."

# --- SCTP module status ---
sctp_loaded=0
sctp_blacklisted=0
sctp_on_disk=0

if lsmod 2>/dev/null | grep -qw '^sctp'; then
  sctp_loaded=1
  echo "[!] SCTP module is currently LOADED."
else
  echo "[+] SCTP module is NOT currently loaded."
fi

if grep -rqsE '(blacklist sctp|install sctp /bin/(true|false))' /etc/modprobe.d/ 2>/dev/null; then
  sctp_blacklisted=1
  echo "[+] SCTP module is BLACKLISTED in /etc/modprobe.d/."
else
  echo "[-] No SCTP blacklist found in /etc/modprobe.d/."
fi

if modinfo sctp &>/dev/null 2>&1; then
  sctp_on_disk=1
fi

# --- Final verdict ---
echo ""
if [ "$sctp_loaded" -eq 1 ]; then
  echo "VULNERABLE — kernel $KVER is unpatched and SCTP module is loaded."
  exit 1
elif [ "$sctp_blacklisted" -eq 1 ]; then
  echo "MITIGATED — kernel $KVER is unpatched but SCTP is blacklisted."
  exit 2
elif [ "$sctp_on_disk" -eq 1 ]; then
  echo "VULNERABLE — kernel $KVER is unpatched and SCTP module can be autoloaded."
  exit 1
else
  echo "MITIGATED — kernel $KVER is unpatched but SCTP module not found on disk."
  exit 2
fi