CVE-2026-53070

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53070", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.382Z", "datePublished": "2026-06-24T16:30:11.816Z", "dateUpdated": "2026-10-30T12:26:35.465Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:26:35.465Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: disable BH before calling udp_tunnel_xmit_skb()\n\nudp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with\nBH disabled. After commit 6f1a9140ecda (\"add xmit recursion limit to\ntunnel xmit functions\"), on the path:\n\n udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit()\n\ndev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.\n\nWithout local_bh_disable(), the context may move between CPUs, which can\nbreak the inc/dec pairing. This may lead to incorrect recursion level\ndetection and cause packets to be dropped in ip(6)_tunnel_xmit() or\n__dev_queue_xmit().\n\nFix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.\n\nIn my testing, after enabling the SCTP over UDP:\n\n # ip net exec ha sysctl -w net.sctp.udp_port=9899\n # ip net exec ha sysctl -w net.sctp.encap_port=9899\n # ip net exec hb sysctl -w net.sctp.udp_port=9899\n # ip net exec hb sysctl -w net.sctp.encap_port=9899\n\n # ip net exec ha iperf3 -s\n\n- without this patch:\n\n # ip net exec hb iperf3 -c 192.168.0.1 --sctp\n [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender\n [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver\n\n- with this patch:\n\n # ip net exec hb iperf3 -c 192.168.0.1 --sctp\n [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender\n [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - SCTP-over-UDP transmit is reachable from network-facing SCTP endpoints when received packets or application-level requests cause replies through the SCTP output path. A remote peer can trigger the affected UDP-encapsulated transmit path in a reasonable SCTP service deployment.\nAC:L - The bug is triggered by repeatedly causing SCTP-over-UDP transmission in process/backlog context where BH is not disabled. Although CPU migration/preemption timing is involved, the attacker can drive repeated transmissions and the higher-severity choice is AC:L.\nPR:N - A remote SCTP peer does not need local credentials or kernel privileges to send packets to an SCTP-over-UDP service and induce responses. Local setup of SCTP-over-UDP may require configuration, but exploitation of an exposed configured service is unauthenticated.\nUI:N - No victim user action is required once an SCTP-over-UDP endpoint is exposed. The attacker only sends network traffic.\nS:U - The impact remains within the kernel networking stack and host network availability. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:N - The bug corrupts transmit recursion accounting, not packet contents or attacker-readable memory. I found no evidence of an information disclosure primitive.\nI:N - The issue causes incorrect recursion detection and packet drops, not arbitrary writes, control-flow hijack, or attacker-controlled data modification. The only modified state is internal transmit recursion accounting.\nA:H - Unbalanced per-CPU transmit recursion counters can become stale or underflowed, causing false recursion-limit detection and persistent packet drops in tunnel or device transmit paths. Repeated triggering can deny network availability for affected SCTP-over-UDP traffic and potentially broader transmit paths on affected CPUs."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/ipv6.c", "net/sctp/protocol.c"], "versions": [{"version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "e2933f5b3a31b175628985b92895269b778674a1", "status": "affected", "versionType": "git"}, {"version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "7f0062c40781fe0a340965f5bb0816681982ff4c", "status": "affected", "versionType": "git"}, {"version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "be3bfcb34bda04f6a350710db471d4133f950f2c", "status": "affected", "versionType": "git"}, {"version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "0de7db2eb27e82b983157016fa604b1ba664ae5f", "status": "affected", "versionType": "git"}, {"version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "790093245e35040c2adb15f48970020425aa3f47", "status": "affected", "versionType": "git"}, {"version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "2cd7e6971fc2787408ceef17906ea152791448cf", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sctp/ipv6.c", "net/sctp/protocol.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.95", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.37", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.95"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.37"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e2933f5b3a31b175628985b92895269b778674a1"}, {"url": "https://git.kernel.org/stable/c/7f0062c40781fe0a340965f5bb0816681982ff4c"}, {"url": "https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c"}, {"url": "https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f"}, {"url": "https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47"}, {"url": "https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf"}], "title": "sctp: disable BH before calling udp_tunnel_xmit_skb()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53070", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:25:08.024827Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:47:14.996Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53070", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:25:08.024827Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:25:08.622Z"}}], "cna": {"title": "sctp: disable BH before calling udp_tunnel_xmit_skb()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - SCTP-over-UDP transmit is reachable from network-facing SCTP endpoints when received packets or application-level requests cause replies through the SCTP output path. A remote peer can trigger the affected UDP-encapsulated transmit path in a reasonable SCTP service deployment.\nAC:L - The bug is triggered by repeatedly causing SCTP-over-UDP transmission in process/backlog context where BH is not disabled. Although CPU migration/preemption timing is involved, the attacker can drive repeated transmissions and the higher-severity choice is AC:L.\nPR:N - A remote SCTP peer does not need local credentials or kernel privileges to send packets to an SCTP-over-UDP service and induce responses. Local setup of SCTP-over-UDP may require configuration, but exploitation of an exposed configured service is unauthenticated.\nUI:N - No victim user action is required once an SCTP-over-UDP endpoint is exposed. The attacker only sends network traffic.\nS:U - The impact remains within the kernel networking stack and host network availability. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:N - The bug corrupts transmit recursion accounting, not packet contents or attacker-readable memory. I found no evidence of an information disclosure primitive.\nI:N - The issue causes incorrect recursion detection and packet drops, not arbitrary writes, control-flow hijack, or attacker-controlled data modification. The only modified state is internal transmit recursion accounting.\nA:H - Unbalanced per-CPU transmit recursion counters can become stale or underflowed, causing false recursion-limit detection and persistent packet drops in tunnel or device transmit paths. Repeated triggering can deny network availability for affected SCTP-over-UDP traffic and potentially broader transmit paths on affected CPUs."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "e2933f5b3a31b175628985b92895269b778674a1", "versionType": "git"}, {"status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "7f0062c40781fe0a340965f5bb0816681982ff4c", "versionType": "git"}, {"status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "be3bfcb34bda04f6a350710db471d4133f950f2c", "versionType": "git"}, {"status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "0de7db2eb27e82b983157016fa604b1ba664ae5f", "versionType": "git"}, {"status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "790093245e35040c2adb15f48970020425aa3f47", "versionType": "git"}, {"status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "lessThan": "2cd7e6971fc2787408ceef17906ea152791448cf", "versionType": "git"}], "programFiles": ["net/sctp/ipv6.c", "net/sctp/protocol.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"status": "unaffected", "version": "0", "lessThan": "5.11", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.191", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.95", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.37", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.10", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/sctp/ipv6.c", "net/sctp/protocol.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e2933f5b3a31b175628985b92895269b778674a1"}, {"url": "https://git.kernel.org/stable/c/7f0062c40781fe0a340965f5bb0816681982ff4c"}, {"url": "https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c"}, {"url": "https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f"}, {"url": "https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47"}, {"url": "https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: disable BH before calling udp_tunnel_xmit_skb()\n\nudp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with\nBH disabled. After commit 6f1a9140ecda (\"add xmit recursion limit to\ntunnel xmit functions\"), on the path:\n\n udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit()\n\ndev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.\n\nWithout local_bh_disable(), the context may move between CPUs, which can\nbreak the inc/dec pairing. This may lead to incorrect recursion level\ndetection and cause packets to be dropped in ip(6)_tunnel_xmit() or\n__dev_queue_xmit().\n\nFix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.\n\nIn my testing, after enabling the SCTP over UDP:\n\n # ip net exec ha sysctl -w net.sctp.udp_port=9899\n # ip net exec ha sysctl -w net.sctp.encap_port=9899\n # ip net exec hb sysctl -w net.sctp.udp_port=9899\n # ip net exec hb sysctl -w net.sctp.encap_port=9899\n\n # ip net exec ha iperf3 -s\n\n- without this patch:\n\n # ip net exec hb iperf3 -c 192.168.0.1 --sctp\n [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender\n [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver\n\n- with this patch:\n\n # ip net exec hb iperf3 -c 192.168.0.1 --sctp\n [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender\n [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.191", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.95", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.37", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.10", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "5.11"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:26:35.465Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53070", "state": "PUBLISHED", "dateUpdated": "2026-10-30T12:26:35.465Z", "dateReserved": "2026-06-09T07:44:35.382Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-06-24T16:30:11.816Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sctp/ipv6.c", "net/sctp/protocol.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e2933f5b3a31b175628985b92895269b778674a1", "status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "versionType": "git"}, {"lessThan": "7f0062c40781fe0a340965f5bb0816681982ff4c", "status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "versionType": "git"}, {"lessThan": "be3bfcb34bda04f6a350710db471d4133f950f2c", "status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "versionType": "git"}, {"lessThan": "0de7db2eb27e82b983157016fa604b1ba664ae5f", "status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "versionType": "git"}, {"lessThan": "790093245e35040c2adb15f48970020425aa3f47", "status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "versionType": "git"}, {"lessThan": "2cd7e6971fc2787408ceef17906ea152791448cf", "status": "affected", "version": "046c052b475e7119b6a30e3483e2888fc606a2f8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sctp/ipv6.c", "net/sctp/protocol.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.95", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.37", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D09C9670-AF2C-4DB7-970E-4E1811E51641", "versionEndExcluding": "6.12.95", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E08ACB05-518A-4D61-A6C4-268D1BB6BF46", "versionEndExcluding": "6.18.37", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: disable BH before calling udp_tunnel_xmit_skb()\n\nudp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with\nBH disabled. After commit 6f1a9140ecda (\"add xmit recursion limit to\ntunnel xmit functions\"), on the path:\n\n udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit()\n\ndev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.\n\nWithout local_bh_disable(), the context may move between CPUs, which can\nbreak the inc/dec pairing. This may lead to incorrect recursion level\ndetection and cause packets to be dropped in ip(6)_tunnel_xmit() or\n__dev_queue_xmit().\n\nFix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.\n\nIn my testing, after enabling the SCTP over UDP:\n\n # ip net exec ha sysctl -w net.sctp.udp_port=9899\n # ip net exec ha sysctl -w net.sctp.encap_port=9899\n # ip net exec hb sysctl -w net.sctp.udp_port=9899\n # ip net exec hb sysctl -w net.sctp.encap_port=9899\n\n # ip net exec ha iperf3 -s\n\n- without this patch:\n\n # ip net exec hb iperf3 -c 192.168.0.1 --sctp\n [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender\n [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver\n\n- with this patch:\n\n # ip net exec hb iperf3 -c 192.168.0.1 --sctp\n [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender\n [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver"}], "id": "CVE-2026-53070", "lastModified": "2026-10-30T13:19:09.543", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53070", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:25:08.024827Z", "version": "2.0.3"}}]}, "published": "2026-06-24T17:17:20.513", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f0062c40781fe0a340965f5bb0816681982ff4c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e2933f5b3a31b175628985b92895269b778674a1"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: sctp: disable BH before calling udp_tunnel_xmit_skb()", "id": "2492347", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492347"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-821", "details": ["A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) over User Datagram Protocol (UDP) implementation. An issue with managing the transmission context across different processing units could lead to incorrect recursion level detection. This can cause network packets to be dropped, resulting in a Denial of Service (DoS) for affected systems."], "name": "CVE-2026-53070", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53070\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53070\nhttps://lore.kernel.org/linux-cve-announce/2026062404-CVE-2026-53070-0031@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[046c052b475e7119b6a30e3483e2888fc606a2f8,790093245e35040c2adb15f48970020425aa3f47)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[046c052b475e7119b6a30e3483e2888fc606a2f8,2cd7e6971fc2787408ceef17906ea152791448cf)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T19:30:08.641300+00:00", "updated": "2026-10-20T14:45:13.858562+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-362", "CWE-821"]}