The Linux kernel’s SCTP over UDP implementation relied on the use of bottom halves (BH) that were not properly disabled during packet transmission. Because the invocation of udp_tunnel_xmit_skb() (and its IPv6 counterpart) expected BH to be disabled, the lack of local_bh_disable caused the kernel to incorrectly adjust recursion counters when the execution context moved between CPUs. This mismatch could lead the kernel to believe it was already at the recursion limit and consequently drop packets in ip(6)_tunnel_xmit() or __dev The effect is loss of data packets, degradation of throughput, and, in high‑traffic scenarios, a measurable denial of service.

All Linux kernel releases that contain the SCTP over UDP path prior to the inclusion of commit 6f1a9140ecda. The exact kernel series is not specified, so any distribution shipping an unpatched kernel before this commit is vulnerable. No specific product or beyond the Linux kernel vendor.

The issue is a race condition (CWE‑362) that can be triggered whenever SCTP over UDP is enabled and remote traffic is sent to the local node. An attacker could flood the node with SCTP traffic to force packet drops, effectively creating a local or remote denial of service. The CVSS and EPSS scores are not available, and the vulnerability is not listed in the CISA KEV catalog, indicating a moderate but not known exploitation risk. Reducing the attack surface by disabling SCTP over UDP mitigates the problem, but the only definitive fix is to update the kernel to a version that includes the commit that disables BH around the SCTP UDP transmit paths.