{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.95-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  sctp: disable BH before calling udp_tunnel_xmit_skb()  udp_tunnel_xmit_skb() / udp_tunnel6_xmit_skb() are expected to run with BH disabled.  After commit 6f1a9140ecda (\"add xmit recursion limit to tunnel xmit functions\"), on the path:    udp(6)_tunnel_xmit_skb() -\u003e ip(6)tunnel_xmit()  dev_xmit_recursion_inc()/dec() must stay balanced on the same CPU.  Without local_bh_disable(), the context may move between CPUs, which can break the inc/dec pairing. This may lead to incorrect recursion level detection and cause packets to be dropped in ip(6)_tunnel_xmit() or __dev_queue_xmit().  Fix it by disabling BH around both IPv4 and IPv6 SCTP UDP xmit paths.  In my testing, after enabling the SCTP over UDP:    # ip net exec ha sysctl -w net.sctp.udp_port=9899   # ip net exec ha sysctl -w net.sctp.encap_port=9899   # ip net exec hb sysctl -w net.sctp.udp_port=9899   # ip net exec hb sysctl -w net.sctp.encap_port=9899    # ip net exec ha iperf3 -s  - without this patch:    # ip net exec hb iperf3 -c 192.168.0.1 --sctp   [  5]   0.00-10.00  sec  37.2 MBytes  31.2 Mbits/sec  sender   [  5]   0.00-10.00  sec  37.1 MBytes  31.1 Mbits/sec  receiver  - with this patch:    # ip net exec hb iperf3 -c 192.168.0.1 --sctp   [  5]   0.00-10.00  sec  3.14 GBytes  2.69 Gbits/sec  sender   [  5]   0.00-10.00  sec  3.14 GBytes  2.69 Gbits/sec  receiver",
  "id": "DEBIAN-CVE-2026-53070",
  "modified": "2026-09-14T16:47:29.785906008Z",
  "published": "2026-06-24T17:17:20.513Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-53070"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-53070"
  ]
}