CVE-2026-53070

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

sctp: disable BH before calling udp_tunnel_xmit_skb()

udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with

BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to

tunnel xmit functions"), on the path:

udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit()

dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.

Without local_bh_disable(), the context may move between CPUs, which can

break the inc/dec pairing. This may lead to incorrect recursion level

detection and cause packets to be dropped in ip(6)_tunnel_xmit() or

__dev_queue_xmit().

Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.

In my testing, after enabling the SCTP over UDP:

# ip net exec ha sysctl -w net.sctp.udp_port=9899

# ip net exec ha sysctl -w net.sctp.encap_port=9899

# ip net exec hb sysctl -w net.sctp.udp_port=9899

# ip net exec hb sysctl -w net.sctp.encap_port=9899

# ip net

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References