CVE-2026-53070sctp: disable BH before calling udp_tunnel_xmit_skb()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path: udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU. Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit(). Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths. In my testing, after enabling the SCTP over UDP: # ip net exec ha sysctl -w net.sctp.udp_port=9899 # ip net exec ha sysctl -w net.sctp.encap_port=9899 # ip net exec hb sysctl -w net.sctp.udp_port=9899 # ip net exec hb sysctl -w net.sctp.encap_port=9899 # ip net exec ha iperf3 -s - without this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver - with this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 046c052b475e7119b6a30e3483e2888fc606a2f8 before be3bfcb34bda04f6a350710db471d4133f950f2c; 046c052b475e7119b6a30e3483e2888fc606a2f8 builds before 0de7db2eb27e82b983157016fa604b1ba664ae5f; from 046c052b475e7119b6a30e3483e2888fc606a2f8 before 790093245e35040c2adb15f48970020425aa3f47; 046c052b475e7119b6a30e3483e2888fc606a2f8 builds before 2cd7e6971fc2787408ceef17906ea152791448cf | CNA record |
linux linux_kernel linux:linux_kernel | from 5.11 before 6.12.95; from 6.13 before 6.18.37; from 6.19 before 7.0.10 | NVD |
References
- https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2cpatch
- https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5fpatch
- https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47patch
- https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cfpatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.