CVE-2026-53070

In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path: udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU. Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit(). Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths. In my testing, after enabling the SCTP over UDP: # ip net exec ha sysctl -w net.sctp.udp_port=9899 # ip net exec ha sysctl -w net.sctp.encap_port=9899 # ip net exec hb sysctl -w net.sctp.udp_port=9899 # ip net exec hb sysctl -w net.sctp.encap_port=9899 # ip net exec ha iperf3 -s - without this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver - with this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver

• https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5fPatch
• https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cfPatch
• https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47Patch
• https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2cPatch

Published

Jun 24, 2026

Last Modified

Jul 21, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53065In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53066In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53067In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2026-53068In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2026-53069In the Linux kernel, the following vulnerability has been re…7.5
• CVE-2026-5307Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2026-53071In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-53072In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-53073In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53074In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2026-53075In the Linux kernel, the following vulnerability has been re…8.8
• CVE-2026-53076In the Linux kernel, the following vulnerability has been re…7.1