CVE-2026-53070: Linux Kernel Race Condition Vulnerability

CVE-2026-53070 Overview

CVE-2026-53070 affects the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation when tunneled over User Datagram Protocol (UDP). The flaw stems from missing bottom-half (BH) disabling around calls to udp_tunnel_xmit_skb() and udp_tunnel6_xmit_skb(). Without BH disabled, the execution context can migrate between CPUs, breaking the balance of dev_xmit_recursion_inc() and dev_xmit_recursion_dec() introduced by commit 6f1a9140ecda. The imbalance causes incorrect recursion level detection in ip_tunnel_xmit(), ip6_tunnel_xmit(), and __dev_queue_xmit(), resulting in dropped packets. The issue affects SCTP-over-UDP throughput, reducing performance from gigabit speeds to tens of megabits per second in maintainer testing.

Critical Impact
Packet drops and severe throughput degradation on SCTP-over-UDP connections due to broken xmit recursion counter pairing across CPU migrations.

Affected Products

Linux kernel versions containing commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions") with SCTP UDP encapsulation enabled
Systems using SCTP over UDP via net.sctp.udp_port and net.sctp.encap_port sysctls
Both IPv4 and IPv6 SCTP UDP transmit paths

Discovery Timeline

2026-06-24 - CVE-2026-53070 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53070

Vulnerability Analysis

The vulnerability is a kernel race condition [CWE-362] in the SCTP UDP encapsulation transmit path. The functions udp_tunnel_xmit_skb() and udp_tunnel6_xmit_skb() require bottom-half processing to be disabled by the caller. The SCTP code paths invoked these helpers without first calling local_bh_disable().

After commit 6f1a9140ecda introduced xmit recursion limits, the underlying ip_tunnel_xmit() and ip6_tunnel_xmit() functions began calling dev_xmit_recursion_inc() and dev_xmit_recursion_dec(). These counters are per-CPU and must increment and decrement on the same processor to remain consistent.

With BH enabled, the scheduler can migrate the task between CPUs between the increment and decrement calls. The mismatched per-CPU counters then misreport recursion depth, causing the transmit path to falsely detect runaway recursion and drop legitimate packets.

Root Cause

The root cause is a missing local_bh_disable() / local_bh_enable() pair around the SCTP code that invokes udp_tunnel_xmit_skb() and udp_tunnel6_xmit_skb(). This violates the documented calling convention of those helpers and breaks the per-CPU pairing of recursion counters introduced after commit 6f1a9140ecda.

Attack Vector

This defect is a reliability and denial-of-service issue rather than a remotely exploitable memory safety flaw. Any workload that sends SCTP traffic encapsulated in UDP can trigger packet drops. The maintainer's iperf3 benchmark demonstrated throughput collapsing from approximately 2.69 Gbits/sec to 31.1 Mbits/sec without the fix, indicating significant service degradation under normal SCTP-over-UDP usage.

The vulnerability is described in prose because no proof-of-concept code is required to reproduce the condition. Enabling SCTP over UDP via net.sctp.udp_port and net.sctp.encap_port and generating SCTP traffic is sufficient. See the Kernel Git Commit Update for the patch.

Detection Methods for CVE-2026-53070

Indicators of Compromise

Sustained packet drops on interfaces carrying SCTP-over-UDP traffic with no corresponding network congestion
SCTP throughput collapsing to tens of Mbits/sec despite available link capacity
Increased counters in __dev_queue_xmit() drop paths and tunnel xmit error statistics

Detection Strategies

Compare kernel version against the fixed commits 2cd7e6971fc2787408ceef17906ea152791448cf and 790093245e35040c2adb15f48970020425aa3f47 in stable trees
Monitor /proc/net/snmp and /proc/net/sctp/snmp for unexpected transmit errors when SCTP UDP encapsulation is active
Use ethtool -S and tc -s qdisc to identify drops localized to SCTP-over-UDP flows

Monitoring Recommendations

Track SCTP-over-UDP throughput metrics with iperf3 or production telemetry and alert on order-of-magnitude regressions
Audit running kernels across fleets to identify hosts with net.sctp.encap_port configured but missing the upstream fix
Enable kernel tracepoints on net_dev_xmit and tunnel xmit paths to capture recursion-related drops

How to Mitigate CVE-2026-53070

Immediate Actions Required

Update to a Linux kernel release containing the upstream fix from commits 2cd7e6971fc2 or 790093245e35
Inventory all systems using SCTP over UDP encapsulation and prioritize them for patching
Validate post-patch throughput with an SCTP iperf3 run to confirm the regression is resolved

Patch Information

The fix wraps the SCTP IPv4 and IPv6 UDP transmit paths with local_bh_disable() and local_bh_enable() so that udp_tunnel_xmit_skb() and udp_tunnel6_xmit_skb() run with bottom halves disabled. This preserves CPU affinity between dev_xmit_recursion_inc() and dev_xmit_recursion_dec(). Refer to the Kernel Git Commit 2cd7e697 and Kernel Git Commit 79009324 for the upstream changes.

Workarounds

Disable SCTP UDP encapsulation where it is not required by setting net.sctp.udp_port=0 and net.sctp.encap_port=0
Route SCTP traffic natively over IP instead of UDP encapsulation until kernels are patched
Restrict SCTP-over-UDP usage to hosts running kernels that already contain the fix

bash

# Disable SCTP UDP encapsulation as a temporary workaround
sysctl -w net.sctp.udp_port=0
sysctl -w net.sctp.encap_port=0

# Verify current kernel against fixed commits
uname -r
# Confirm SCTP-over-UDP throughput post-patch
ip netns exec hb iperf3 -c 192.168.0.1 --sctp