CVE-2026-53070

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> sctp: disable BH before calling udp_tunnel_xmit_skb()<br /> <br /> udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with<br /> BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to<br /> tunnel xmit functions"), on the path:<br /> <br /> udp(6)_tunnel_xmit_skb() -&gt; ip(6)tunnel_xmit()<br /> <br /> dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.<br /> <br /> Without local_bh_disable(), the context may move between CPUs, which can<br /> break the inc/dec pairing. This may lead to incorrect recursion level<br /> detection and cause packets to be dropped in ip(6)_tunnel_xmit() or<br /> __dev_queue_xmit().<br /> <br /> Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.<br /> <br /> In my testing, after enabling the SCTP over UDP:<br /> <br /> # ip net exec ha sysctl -w net.sctp.udp_port=9899<br /> # ip net exec ha sysctl -w net.sctp.encap_port=9899<br /> # ip net exec hb sysctl -w net.sctp.udp_port=9899<br /> # ip net exec hb sysctl -w net.sctp.encap_port=9899<br /> <br /> # ip net exec ha iperf3 -s<br /> <br /> - without this patch:<br /> <br /> # ip net exec hb iperf3 -c 192.168.0.1 --sctp<br /> [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender<br /> [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver<br /> <br /> - with this patch:<br /> <br /> # ip net exec hb iperf3 -c 192.168.0.1 --sctp<br /> [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender<br /> [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver