CVE-2026-80890
Received Received - Intake

SCTP Cookie Replay Leading to Association Restart in Linux Kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp_unpack_cookie() skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing association, Section 5.2.4 permits an expired State Cookie only when both Verification Tags in the cookie match the current association. Otherwise, the packet SHOULD be discarded and a Stale Cookie ERROR MUST be sent. The broad check lets an expired Action A restart cookie reach sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second cookie lifetime, replaying such a cookie after 65 seconds returned a COOKIE-ACK and restarted the association. Check cookie expiration unless both Verification Tags match. This preserves the Action D exception for a lost COOKIE ACK while rejecting expired cookies in all other cases.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-05
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80890
EUVD
EUVD-2026-71640

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves the SCTP protocol incorrectly handling stale cookies with mismatched verification tags. The function sctp_unpack_cookie() skips expiration checks for existing associations, which violates RFC 9260 Section 5.2.4. This allows an attacker to replay an expired cookie after the association's lifetime, restarting the association and potentially causing unauthorized access or disruption.

Detection Guidance

This vulnerability affects the Linux kernel's SCTP implementation. Detection requires checking kernel logs for SCTP cookie-related errors or examining network traffic for malformed packets. Use commands like 'dmesg | grep sctp' or 'journalctl -k | grep sctp' to inspect kernel logs for SCTP-related errors. Monitor network traffic with tools like tcpdump or Wireshark for SCTP packets with mismatched verification tags.

Impact Analysis

If exploited, this vulnerability could allow an attacker to restart an SCTP association by replaying an expired cookie, leading to unauthorized access, data corruption, or denial of service. Systems using SCTP for communication may experience unexpected behavior or security breaches.

Mitigation Strategies

Immediately update the Linux kernel to the latest patched version provided by your distribution. If updating is not immediately possible, consider disabling SCTP support if not required, using kernel parameters like 'sctp.disable=1'. Apply firewall rules to filter SCTP traffic if feasible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart