CVE-2026-53070
sctp: disable BH before calling udp_tunnel_xmit_skb()
Description
In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path: udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU. Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit(). Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths. In my testing, after enabling the SCTP over UDP: # ip net exec ha sysctl -w net.sctp.udp_port=9899 # ip net exec ha sysctl -w net.sctp.encap_port=9899 # ip net exec hb sysctl -w net.sctp.udp_port=9899 # ip net exec hb sysctl -w net.sctp.encap_port=9899 # ip net exec ha iperf3 -s - without this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver - with this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver
INFO
Published Date :
June 24, 2026, 5:17 p.m.
Last Modified :
July 21, 2026, 5:39 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Disable BH before calling udp_tunnel_xmit_skb().
- Apply the patch to the Linux kernel.
- Recompile and install the updated kernel.
- Reboot the system with the new kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53070.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53070 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53070
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53070 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53070 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 21, 2026
Action Type Old Value New Value Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.37 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 6.12.95 Added Reference Type kernel.org: https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 04, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '0de7db2eb27e82b983157016fa604b1ba664ae5f', 'versionType': 'git'}, {'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '790093245e35040c2adb15f48970020425aa3f47', 'versionType': 'git'}, {'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '2cd7e6971fc2787408ceef17906ea152791448cf', 'versionType': 'git'}], 'programFiles': ['net/sctp/ipv6.c', 'net/sctp/protocol.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.37', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/sctp/ipv6.c', 'net/sctp/protocol.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': 'be3bfcb34bda04f6a350710db471d4133f950f2c', 'versionType': 'git'}, {'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '0de7db2eb27e82b983157016fa604b1ba664ae5f', 'versionType': 'git'}, {'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '790093245e35040c2adb15f48970020425aa3f47', 'versionType': 'git'}, {'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '2cd7e6971fc2787408ceef17906ea152791448cf', 'versionType': 'git'}], 'programFiles': ['net/sctp/ipv6.c', 'net/sctp/protocol.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.37', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/sctp/ipv6.c', 'net/sctp/protocol.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 27, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '790093245e35040c2adb15f48970020425aa3f47', 'versionType': 'git'}, {'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '2cd7e6971fc2787408ceef17906ea152791448cf', 'versionType': 'git'}], 'programFiles': ['net/sctp/ipv6.c', 'net/sctp/protocol.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/sctp/ipv6.c', 'net/sctp/protocol.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '0de7db2eb27e82b983157016fa604b1ba664ae5f', 'versionType': 'git'}, {'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '790093245e35040c2adb15f48970020425aa3f47', 'versionType': 'git'}, {'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '2cd7e6971fc2787408ceef17906ea152791448cf', 'versionType': 'git'}], 'programFiles': ['net/sctp/ipv6.c', 'net/sctp/protocol.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.18.37', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/sctp/ipv6.c', 'net/sctp/protocol.c'], 'defaultStatus': 'affected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '790093245e35040c2adb15f48970020425aa3f47', 'versionType': 'git'}, {'status': 'affected', 'version': '046c052b475e7119b6a30e3483e2888fc606a2f8', 'lessThan': '2cd7e6971fc2787408ceef17906ea152791448cf', 'versionType': 'git'}], 'programFiles': ['net/sctp/ipv6.c', 'net/sctp/protocol.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.11'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.11', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/sctp/ipv6.c', 'net/sctp/protocol.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path: udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU. Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit(). Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths. In my testing, after enabling the SCTP over UDP: # ip net exec ha sysctl -w net.sctp.udp_port=9899 # ip net exec ha sysctl -w net.sctp.encap_port=9899 # ip net exec hb sysctl -w net.sctp.udp_port=9899 # ip net exec hb sysctl -w net.sctp.encap_port=9899 # ip net exec ha iperf3 -s - without this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver - with this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver Added Reference https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf Added Reference https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47