CVE-2026-53070 - Vulnerability Details

- sctp: disable BH before calling udp_tunnel_xmit_skb()

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: disable BH before calling udp_tunnel_xmit_skb()

udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with
BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to
tunnel xmit functions"), on the path:

udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit()

dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.

Without local_bh_disable(), the context may move between CPUs, which can
break the inc/dec pairing. This may lead to incorrect recursion level
detection and cause packets to be dropped in ip(6)_tunnel_xmit() or
__dev_queue_xmit().

Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.

In my testing, after enabling the SCTP over UDP:

# ip net exec ha sysctl -w net.sctp.udp_port=9899
# ip net exec ha sysctl -w net.sctp.encap_port=9899
# ip net exec hb sysctl -w net.sctp.udp_port=9899
# ip net exec hb sysctl -w net.sctp.encap_port=9899

# ip net exec ha iperf3 -s

- without this patch:

# ip net exec hb iperf3 -c 192.168.0.1 --sctp
[ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender
[ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver

- with this patch:

# ip net exec hb iperf3 -c 192.168.0.1 --sctp
[ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender
[ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver

Published: 2026-06-24

Score: 7.5 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s SCTP over UDP implementation performs packet transmission in a code path that expects bottom halves (BH) to be disabled. A patch commit added a recursion limit to the tunnel transmission functions but forgot to disable BH in the SCTP UDP transmit functions. Without calling local_bh_disable(), the thread context may migrate between CPUs, breaking the balancing of recursion counters. This race condition causes the kernel to mis‑detect recursion limits, leading to drops in ip(6)_tunnel_xmit() or __dev_queue_xmit(). The observed effect is a dramatic reduction in SCTP throughput and potential denial of service for traffic protected by SCTP over UDP.

Affected Systems

All Linux kernel releases that ship before the inclusion of commit 6f1a9140ecda. The vulnerability exists in the generic Linux kernel and is not tied to a particular distribution or kernel series in the data provided. Any system running an unpatched kernel with SCTP over UDP enabled is affected.

Risk and Exploitability

The CVSS score of 7.5 marks this as a high‑severity race condition (CWE-362). The EPSS score is less than 1 %, indicating a very low probability of an active exploit at current time. The vulnerability is not listed in CISA’s KEV catalog, further suggesting limited real‑world exploitation. Attackers who can generate large volumes of SCTP over UDP traffic may force the vulnerable kernel to drop packets and degrade throughput, effectively creating a denial‑of‑service scenario. The only documented remediation is to apply a kernel patch that disables BH around the SCTP UDP transmit paths.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`046c052b475e7119b6a30e3483e2888fc606a2f8`	affected	< 7f0062c40781fe0a340965f5bb0816681982ff4c
`046c052b475e7119b6a30e3483e2888fc606a2f8`	affected	< be3bfcb34bda04f6a350710db471d4133f950f2c
`046c052b475e7119b6a30e3483e2888fc606a2f8`	affected	< 0de7db2eb27e82b983157016fa604b1ba664ae5f
`046c052b475e7119b6a30e3483e2888fc606a2f8`	affected	< 790093245e35040c2adb15f48970020425aa3f47
`046c052b475e7119b6a30e3483e2888fc606a2f8`	affected	< 2cd7e6971fc2787408ceef17906ea152791448cf

Linux

affected

Version	Status	Constraints
`5.11`	affected	—
`0`	unaffected	< 5.11
`6.6.160`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.37`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[046c052b475e7119b6a30e3483e2888fc606a2f8,790093245e35040c2adb15f48970020425aa3f47)`	affected	code_commit	—
`[046c052b475e7119b6a30e3483e2888fc606a2f8,2cd7e6971fc2787408ceef17906ea152791448cf)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.11`	affected	semver	—
`[0,5.11)`	unaffected	generic	—
`[7.0.10,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the kernel to a version that contains commit 6f1a9140ecda or later, which disables BH in the SCTP UDP transmit functions.
If SCTP over UDP is not required for your environment, disable it by setting the sysctl parameters net.sctp.udp_port=0 and net.sctp.encap_port=0 to eliminate use of the vulnerable code path.
For environments that must continue to use SCTP over UDP, implement network‑level controls—such as rate‑limiting or selective filtering—to moderate the volume of SCTP traffic and reduce the likelihood of triggering the race condition during normal operation.

Generated by OpenCVE AI on October 20, 2026 at 14:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6381-1	linux security update
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8917-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8918-1	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00276.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f
https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf
https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47
https://git.kernel.org/stable/c/7f0062c40781fe0a340965f5bb0816681982ff4c
https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c
https://lore.kernel.org/linux-cve-announce/2026062404-CVE-2026-53070-0031@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53070
https://www.cve.org/CVERecord?id=CVE-2026-53070

History

Wed, 21 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/7f0062c40781fe0a340965f5bb0816681982ff4c

Mon, 19 Oct 2026 21:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 19 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Sat, 04 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Sat, 27 Jun 2026 10:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-821
References		https://lore.kernel.org/linux-cve-announce/2026062404-CVE-2026-53070-0031@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53070 https://www.cve.org/CVERecord?id=CVE-2026-53070
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path: udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU. Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit(). Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths. In my testing, after enabling the SCTP over UDP: # ip net exec ha sysctl -w net.sctp.udp_port=9899 # ip net exec ha sysctl -w net.sctp.encap_port=9899 # ip net exec hb sysctl -w net.sctp.udp_port=9899 # ip net exec hb sysctl -w net.sctp.encap_port=9899 # ip net exec ha iperf3 -s - without this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver - with this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver
Title		sctp: disable BH before calling udp_tunnel_xmit_skb()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:30:11.816Z

Updated: 2026-10-21T12:41:55.397Z

Reserved: 2026-06-09T07:44:35.382Z

Link: CVE-2026-53070

Vulnrichment

Updated: 2026-10-16T15:25:08.622Z

NVD

Status : Modified

Published: 2026-06-24T17:17:20.513

Modified: 2026-10-21T13:19:09.630

Link: CVE-2026-53070

Redhat

Severity : Moderate

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-53070 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-20T14:45:13Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-821
Incorrect Synchronization
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object