7.5

CVE-2026-53070: linux Race Condition

CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2026-53070DEBIAN-CVE-2026-53070CGA-c9h8-8338-mh39
Published 24-06-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-53070 is a high (CVSS 7.5) Race Condition vulnerability in linux. EPSS estimates a 0.35% chance of exploitation in the next 30 days, higher than 26.6% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.35%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 26 · Related 27
OPENSUSE-SU-2026:21555-1SUSE-SU-2026:23066-1SUSE-SU-2026:23068-1SUSE-SU-2026:23193-1SUSE-SU-2026:23194-1SUSE-SU-2026:23221-1

Timeline

  1. 24-06-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udp_tunnel_xmit_skb() udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled. After commit 6f1a9140ecda ("add xmit recursion limit to tunnel xmit functions"), on the path: udp(6)_tunnel_xmit_skb() -> ip(6)tunnel_xmit() dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU. Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit(). Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths. In my testing, after enabling the SCTP over UDP: # ip net exec ha sysctl -w net.sctp.udp_port=9899 # ip net exec ha sysctl -w net.sctp.encap_port=9899 # ip net exec hb sysctl -w net.sctp.udp_port=9899 # ip net exec hb sysctl -w net.sctp.encap_port=9899 # ip net exec ha iperf3 -s - without this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 37.2 MBytes 31.2 Mbits/sec sender [ 5] 0.00-10.00 sec 37.1 MBytes 31.1 Mbits/sec receiver - with this patch: # ip net exec hb iperf3 -c 192.168.0.1 --sctp [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec sender [ 5] 0.00-10.00 sec 3.14 GBytes 2.69 Gbits/sec receiver

CVSS metrics

6 scores · 5 sources · 2 versions

EPSS trend

Probability

0.35%

Chance of exploitation in the next 30 days

Percentile

27%

Versus all other CVEs

30-day change

0.00 pp

From 0.35% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.35%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Ubuntu156 products
  • linuxAll versions (No fix recorded) | < 6.8.0-147.147 | < 7.0.0-28.28
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 6.8.0-1067.70 | < 7.0.0-1009.9
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 046c052b475e7119b6a30e3483e2888fc606a2f8, < be3bfcb34bda04f6a350710db471d4133f950f2c | ≥ 046c052b475e7119b6a30e3483e2888fc606a2f8, < 0de7db2eb27e82b983157016fa604b1ba664ae5f | ≥ 046c052b475e7119b6a30e3483e2888fc606a2f8, < 790093245e35040c2adb15f48970020425aa3f47 | ≥ 046c052b475e7119b6a30e3483e2888fc606a2f8, < 2cd7e6971fc2787408ceef17906ea152791448cf | 5.11
  • linux_kernel≥ 5.11, < 6.12.95 | ≥ 6.13, < 6.18.37 | ≥ 6.19, < 7.0.10
Chainguard1 product
  • linux-gcp-6.12< 6.12.96-r0
Debian1 product
  • linuxAll versions (No fix recorded) | < 6.12.95-1 | < 7.0.10-1

4 vendors · 160 products

References

25 links
Show all 25 references