Skip to main content

Linux Kernel CVE-2026-53070

| EUVDEUVD-2026-38938 HIGH
Race Condition (CWE-362)
2026-06-24 Linux GHSA-q4jf-gp35-367g
Information Disclosure Linux Race Condition
7.5
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Host configured with SCTP-over-UDP encap
  2. Delivery
    SCTP traffic enters udp_tunnel_xmit path
  3. Exploit
    BH not disabled, context migrates CPUs
  4. Execution
    Recursion counter inc/dec unbalanced
  5. Persist
    False recursion-limit detection
  6. Impact
    Packets dropped, throughput collapses (DoS)

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires the target Linux host to have SCTP-over-UDP encapsulation explicitly enabled - specifically sysctls net.sctp.udp_port and net.sctp.encap_port configured (non-default) and active SCTP traffic flowing through the UDP tunnel. The fault is triggered by the kernel's own transmit path migrating between CPUs while the recursion counter is unbalanced, not by attacker-controlled packet content. Limiting factors: default kernels that do not enable SCTP UDP encapsulation are unaffected; impact is degraded availability/throughput rather than code execution or data exposure; and there is no evidence an external attacker can reliably force the CPU-migration timing, so practical exploitability beyond self-inflicted degradation is unconfirmed.
Impact

Signals are mostly consistent toward low real-world urgency despite the 7.5 'High' base score. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H scores availability-only impact, but the actual described effect is throughput collapse (~31 Mbit/s vs ~2.69 Gbit/s) and stray packet drops - a functional/performance regression that manifests only when SCTP-over-UDP encapsulation is actively configured and in use, not against default kernels. EPSS is very low (0.14%, 4th percentile), it is NOT in CISA KEV, and no public exploit is identified. The AV:N rating is debatable: triggering the imbalance depends on internal CPU-migration timing of the host's own tunnel transmit path rather than on an attacker-supplied network input, so the practical 'remote attacker' applicability is weak - treat the network vector as nominal. Note a data conflict: the Tags field lists 'Information Disclosure,' which contradicts the CVSS (C:N/I:N) and the description (a packet-drop/availability issue) - the tag appears to be a mislabel and should not drive triage. Overall this is a low-priority correctness fix, not an attacker-driven threat.
Exploit ScenarioDerived

On a host configured for SCTP-over-UDP (net.sctp.udp_port and net.sctp.encap_port set), normal SCTP traffic transmitted through the UDP tunnel triggers CPU migration that unbalances the per-CPU recursion counter, causing the kernel to falsely detect transmit recursion and drop the packets. The observable result is a denial of service in the form of collapsed SCTP throughput (demonstrated as ~31 Mbit/s instead of ~2.69 Gbit/s) and intermittent loss. No public exploit code is identified; the condition arises from legitimate traffic rather than a crafted attack.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Denial-of-service (packet drops and severe throughput degradation) affects the Linux kernel SCTP-over-UDP encapsulation path, where udp_tunnel_xmit_skb()/udp_tunnel6_xmit_skb() were called without disabling bottom halves. After the xmit recursion-limit change (commit 6f1a9140ecda), the unbalanced per-CPU dev_xmit_recursion_inc/dec pairing can misdetect recursion and drop packets in ip(6)_tunnel_xmit() or __dev_queue_xmit(). CVSS 7.5 (A:H) reflects availability impact only; EPSS is low (0.14%, 4th percentile) and there is no public exploit identified at time of analysis.

RemediationAI

Apply the upstream kernel fix that wraps both the IPv4 and IPv6 SCTP UDP transmit paths in local_bh_disable()/local_bh_enable(); it is available in the stable trees as commits 790093245e35040c2adb15f48970020425aa3f47 and 2cd7e6971fc2787408ceef17906ea152791448cf (https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47 and https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf; see also https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f), corresponding to fixed releases noted as 7.0.10 and 7.1. Update to a distribution kernel that incorporates these commits. As an interim compensating control, if SCTP-over-UDP encapsulation is not required, leave it disabled (do not set net.sctp.udp_port / net.sctp.encap_port) so the buggy path is never exercised - the trade-off is loss of SCTP NAT-traversal/UDP-encapsulation capability for hosts that genuinely need it. No firewall rule meaningfully mitigates this since it is a local transmit-path correctness bug rather than a parseable malicious input.

Affected VersionsENISA

Linux patch: 0
Linux patch: 7.0.10
Linux 046c052b475e7119b6a30e3483e2888fc606a2f8 <790093245e35040c2adb15f48970020425aa3f47
Linux 5.11
Linux patch: 7.1
Linux 046c052b475e7119b6a30e3483e2888fc606a2f8 <2cd7e6971fc2787408ceef17906ea152791448cf

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the kernel's SCTP-over-UDP tunneling code (net/sctp), which encapsulates SCTP datagrams inside UDP using the generic udp_tunnel transmit helpers. These helpers, udp_tunnel_xmit_skb() and udp_tunnel6_xmit_skb(), are documented to run with bottom halves (softirq context) disabled. A prior commit (6f1a9140ecda, 'add xmit recursion limit to tunnel xmit functions') introduced per-CPU recursion counters via dev_xmit_recursion_inc()/dec() in ip(6)tunnel_xmit(); these must increment and decrement on the same CPU. Because SCTP invoked the tunnel xmit path without local_bh_disable(), the execution context could migrate between CPUs mid-flow, unbalancing the counter and tripping false recursion-limit detection. The root cause is a context/locking discipline violation (missing BH disable around a softirq-expecting code path) rather than a memory-safety bug; no CWE was assigned in the source data.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 2.5 LOW

Requires non-default SCTP-over-UDP config (PR:L) and race-dependent CPU migration (AC:H); impact is degraded throughput on the local host (AV:L, A:L), with no confidentiality or integrity effect.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.5 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sctp: disable BH before calling udp_tunnel_xmit_skb()

udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path:

udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit()

dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.

Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit().

Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.

In my testing, after enabling the SCTP over UDP:

ip net exec ha sysctl -w net.sctp.udp_port=9899

ip net exec ha sysctl -w net.sctp.encap_port=9899

ip net exec hb sysctl -w net.sctp.udp_port=9899

ip net exec hb sysctl -w net.sctp.encap_port=9899

ip net exec ha iperf3 -s

  • without this patch:

ip net exec hb iperf3 -c 192.168.0.1 --sctp

[ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver

  • with this patch:

ip net exec hb iperf3 -c 192.168.0.1 --sctp

[ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver

Executive ViewAI

Why It Matters

A Linux kernel vulnerability in SCTP-over-UDP packet handling can disrupt network throughput and data transmission on affected systems through denial-of-service conditions. This impacts organizations relying on these network tunnel implementations for critical infrastructure. While no public exploit has been identified, vendor patches are available and should be prioritized for production deployment.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 96% exploitable
Prevalence
Ubiquitous
Linux kernel runs across the vast majority of server and cloud deployments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Image SLES15-SP7-Azure-3P Image SLES15-SP7-Azure-Basic Image SLES15-SP7-Azure-Standard Image SLES15-SP7-HPC-Azure Affected
Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-Aliyun Image SLES15-SP7-CHOST-BYOS-Azure Image SLES15-SP7-CHOST-BYOS-EC2 Image SLES15-SP7-CHOST-BYOS-GCE Image SLES15-SP7-CHOST-BYOS-GDC Image SLES15-SP7-CHOST-BYOS-SAP-CCloud Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-HPC-BYOS-GCE Image SLES15-SP7-Hardened-BYOS-Azure Image SLES15-SP7-Hardened-BYOS-EC2 Image SLES15-SP7-Hardened-BYOS-GCE Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Image SLES15-SP7-SAP-Azure Image SLES15-SP7-SAP-Azure-3P Image SLES15-SP7-SAP-BYOS-Azure Image SLES15-SP7-SAP-BYOS-EC2 Image SLES15-SP7-SAP-BYOS-GCE Image SLES15-SP7-SAP-EC2 Image SLES15-SP7-SAP-GCE Image SLES15-SP7-SAP-Hardened-Azure Image SLES15-SP7-SAP-Hardened-BYOS-Azure Image SLES15-SP7-SAP-Hardened-BYOS-EC2 Image SLES15-SP7-SAP-Hardened-BYOS-GCE Image SLES15-SP7-SAP-Hardened-GCE Affected
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53070 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373479 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3130/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3166/ REF https://git.kernel.org/stable/c/0de7db2eb27e82b983157016fa604b1ba664ae5f REF https://git.kernel.org/stable/c/2cd7e6971fc2787408ceef17906ea152791448cf REF https://git.kernel.org/stable/c/790093245e35040c2adb15f48970020425aa3f47 REF https://git.kernel.org/stable/c/7f0062c40781fe0a340965f5bb0816681982ff4c REF https://git.kernel.org/stable/c/be3bfcb34bda04f6a350710db471d4133f950f2c REF https://git.kernel.org/stable/c/e2933f5b3a31b175628985b92895269b778674a1

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy