GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-53070 (GCVE-0-2026-53070)

Vulnerability from cvelistv5 – Published: 2026-06-24 16:30 – Updated: 2026-08-05 12:33
VLAI
Title
sctp: disable BH before calling udp_tunnel_xmit_skb()
Summary
In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path: udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU. Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit(). Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths. In my testing, after enabling the SCTP over UDP: # ip net exec ha sysctl -w net.sctp.udp_port=9899 # ip net exec ha sysctl -w net.sctp.encap_port=9899 # ip net exec hb sysctl -w net.sctp.udp_port=9899 # ip net exec hb sysctl -w net.sctp.encap_port=9899 # ip net exec ha iperf3 -s - without this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver - with this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 046c052b475e7119b6a30e3483e2888fc606a2f8 , < be3bfcb34bda04f6a350710db471d4133f950f2c (git)
Affected: 046c052b475e7119b6a30e3483e2888fc606a2f8 , < 0de7db2eb27e82b983157016fa604b1ba664ae5f (git)
Affected: 046c052b475e7119b6a30e3483e2888fc606a2f8 , < 790093245e35040c2adb15f48970020425aa3f47 (git)
Affected: 046c052b475e7119b6a30e3483e2888fc606a2f8 , < 2cd7e6971fc2787408ceef17906ea152791448cf (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 6.12.95 , ≤ 6.12.* (semver)
Unaffected: 6.18.37 , ≤ 6.18.* (semver)
Unaffected: 7.0.10 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/ipv6.c",
            "net/sctp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "be3bfcb34bda04f6a350710db471d4133f950f2c",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "0de7db2eb27e82b983157016fa604b1ba664ae5f",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "790093245e35040c2adb15f48970020425aa3f47",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            },
            {
              "lessThan": "2cd7e6971fc2787408ceef17906ea152791448cf",
              "status": "affected",
              "version": "046c052b475e7119b6a30e3483e2888fc606a2f8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sctp/ipv6.c",
            "net/sctp/protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.95",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.37",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.95",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.37",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: disable BH before calling udp_tunnel_xmit_skb()\n\nudp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with\nBH disabled.  After commit 6f1a9140ecda (\"add xmit recursion limit to\ntunnel xmit functions\"), on the path:\n\n  udp(6)_tunnel_xmit_skb() -\u003e ip(6)tunnel_xmit()\n\ndev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.\n\nWithout local_bh_disable(), the context may move between CPUs, which can\nbreak the inc/dec pairing. This may lead to incorrect recursion level\ndetection and cause packets to be dropped in ip(6)_tunnel_xmit() or\n__dev_queue_xmit().\n\nFix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.\n\nIn my testing, after enabling the SCTP over UDP:\n\n  # ip net exec ha sysctl -w net.sctp.udp_port=9899\n  # ip net exec ha sysctl -w net.sctp.encap_port=9899\n  # ip net exec hb sysctl -w net.sctp.udp_port=9899\n  # ip net exec hb sysctl -w net.sctp.encap_port=9899\n\n  # ip net exec ha iperf3 -s\n\n- without this patch:\n\n  # ip net exec hb iperf3 -c 192.168.0.1 --sctp\n  [  5]   0.00-10.00  sec  37.2 MBytes  31.2 Mbits/sec  sender\n  [  5]   0.00-10.00  sec  37.1 MBytes  31.1 Mbits/sec  receiver\n\n- with this patch:\n\n  # ip net exec hb iperf3 -c 192.168.0.1 --sctp\n  [  5]   0.00-10.00  sec  3.14 GBytes  2.69 Gbits/sec  sender\n  [  5]   0.00-10.00  sec  3.14 GBytes  2.69 Gbits/sec  receiver"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - SCTP-over-UDP transmit is reachable from network-facing SCTP endpoints when received packets or application-level requests cause replies through the SCTP output path. A remote peer can trigger the affected UDP-encapsulated transmit path in a reasonable SCTP service deployment.\nAC:L - The bug is triggered by repeatedly causing SCTP-over-UDP transmission in process/backlog context where BH is not disabled. Although CPU migration/preemption timing is involved, the attacker can drive repeated transmissions and the higher-severity choice is AC:L.\nPR:N - A remote SCTP peer does not need local credentials or kernel privileges to send packets to an SCTP-over-UDP service and induce responses. Local setup of SCTP-over-UDP may require configuration, but exploitation of an exposed configured service is unauthenticated.\nUI:N - No victim user action is required once an SCTP-over-UDP endpoint is exposed. The attacker only sends network traffic.\nS:U - The impact remains within the kernel networking stack and host network availability. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:N - The bug corrupts transmit recursion accounting, not packet contents or attacker-readable memory. I found no evidence of an information disclosure primitive.\nI:N - The issue causes incorrect recursion detection and packet drops, not arbitrary writes, control-flow hijack, or attacker-controlled data modification. The only modified state is internal transmit recursion accounting.\nA:H - Unbalanced per-CPU transmit recursion counters can become stale or underflowed, causing false recursion-limit detection and persistent packet drops in tunnel or device transmit paths. Repeated triggering can deny network availability for affected SCTP-over-UDP traffic and potentially broader transmit paths on affected CPUs."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:33:04.761Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf"
        }
      ],
      "title": "sctp: disable BH before calling udp_tunnel_xmit_skb()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53070",
    "datePublished": "2026-06-24T16:30:11.816Z",
    "dateReserved": "2026-06-09T07:44:35.382Z",
    "dateUpdated": "2026-08-05T12:33:04.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-53070",
      "date": "2026-09-16",
      "epss": "0.00346",
      "percentile": "0.2799"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:12:03.000Z",
      "cve": "CVE-2026-53070",
      "id": "msrc_CVE-2026-53070",
      "initial_release_date": "2026-06-27T01:18:12.000Z",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "sctp: disable BH before calling udp_tunnel_xmit_skb()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-53070.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-53070\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-24T17:17:20.513\",\"lastModified\":\"2026-07-21T17:39:27.027\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nsctp: disable BH before calling udp_tunnel_xmit_skb()\\n\\nudp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with\\nBH disabled.  After commit 6f1a9140ecda (\\\"add xmit recursion limit to\\ntunnel xmit functions\\\"), on the path:\\n\\n  udp(6)_tunnel_xmit_skb() -\u003e ip(6)tunnel_xmit()\\n\\ndev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.\\n\\nWithout local_bh_disable(), the context may move between CPUs, which can\\nbreak the inc/dec pairing. This may lead to incorrect recursion level\\ndetection and cause packets to be dropped in ip(6)_tunnel_xmit() or\\n__dev_queue_xmit().\\n\\nFix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.\\n\\nIn my testing, after enabling the SCTP over UDP:\\n\\n  # ip net exec ha sysctl -w net.sctp.udp_port=9899\\n  # ip net exec ha sysctl -w net.sctp.encap_port=9899\\n  # ip net exec hb sysctl -w net.sctp.udp_port=9899\\n  # ip net exec hb sysctl -w net.sctp.encap_port=9899\\n\\n  # ip net exec ha iperf3 -s\\n\\n- without this patch:\\n\\n  # ip net exec hb iperf3 -c 192.168.0.1 --sctp\\n  [  5]   0.00-10.00  sec  37.2 MBytes  31.2 Mbits/sec  sender\\n  [  5]   0.00-10.00  sec  37.1 MBytes  31.1 Mbits/sec  receiver\\n\\n- with this patch:\\n\\n  # ip net exec hb iperf3 -c 192.168.0.1 --sctp\\n  [  5]   0.00-10.00  sec  3.14 GBytes  2.69 Gbits/sec  sender\\n  [  5]   0.00-10.00  sec  3.14 GBytes  2.69 Gbits/sec  receiver\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sctp/ipv6.c\",\"net/sctp/protocol.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"046c052b475e7119b6a30e3483e2888fc606a2f8\",\"lessThan\":\"be3bfcb34bda04f6a350710db471d4133f950f2c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"046c052b475e7119b6a30e3483e2888fc606a2f8\",\"lessThan\":\"0de7db2eb27e82b983157016fa604b1ba664ae5f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"046c052b475e7119b6a30e3483e2888fc606a2f8\",\"lessThan\":\"790093245e35040c2adb15f48970020425aa3f47\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"046c052b475e7119b6a30e3483e2888fc606a2f8\",\"lessThan\":\"2cd7e6971fc2787408ceef17906ea152791448cf\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sctp/ipv6.c\",\"net/sctp/protocol.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.95\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.37\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.10\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"6.12.95\",\"matchCriteriaId\":\"D09C9670-AF2C-4DB7-970E-4E1811E51641\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.37\",\"matchCriteriaId\":\"E08ACB05-518A-4D61-A6C4-268D1BB6BF46\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.10\",\"matchCriteriaId\":\"A13475D2-59BF-4716-94B5-7C1D239A2CF4\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-04T13:04:33+00:00",
      "cve": "CVE-2026-53070",
      "id": "CVE-2026-53070",
      "initial_release_date": "2026-06-24T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: sctp: disable BH before calling udp_tunnel_xmit_skb()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53070.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T16:45:54Z",
      "cve": "CVE-2026-53070",
      "id": "CVE-2026-53070",
      "initial_release_date": "2026-07-01T03:19:17Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "134",
      "product_status:known_not_affected": "202",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-53070",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-53070.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.