CVE-2026-53070

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: disable BH before calling udp_tunnel_xmit_skb()

udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with

BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to

tunnel xmit functions"), on the path:

udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit()

dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.

Without local_bh_disable(), the context may move between CPUs, which can

break the inc/dec pairing. This may lead to incorrect recursion level

detection and cause packets to be dropped in ip(6)_tunnel_xmit() or

__dev_queue_xmit().

Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.

In my testing, after enabling the SCTP over UDP:

# ip net exec ha sysctl -w net.sctp.udp_port=9899

# ip net exec ha sysctl -w net.sctp.encap_port=9899

# ip net exec hb sysctl -w net.sctp.udp_port=9899

# ip net exec hb sysctl -w net.sctp.encap_port=9899

# ip net

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References