In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp_unpack_cookie() skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing association, Section 5.2.4 permits an expired State Cookie only when both Verification Tags in the cookie match the current association. Otherwise, the packet SHOULD be discarded and a Stale Cookie ERROR MUST be sent. The broad check lets an expired Action A restart cookie reach sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second cookie lifetime, replaying such a cookie after 65 seconds returned a COOKIE-ACK and restarted the association. Check cookie expiration unless both Verification Tags match. This preserves the Action D exception for a lost COOKIE ACK while rejecting expired cookies in all other cases.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/35c279113498d19a8734e2aae67b951b9b20f634 cve-icon cve-icon
https://git.kernel.org/stable/c/61baa5020b0afb41bfd97f8f6ce5e336c4a4546e cve-icon cve-icon
https://git.kernel.org/stable/c/817cffdbdbdf50e1f2b016599d1897de3ca54964 cve-icon cve-icon
https://git.kernel.org/stable/c/9d8da8e0a9bce4a340af60dd0446bc7eb8d07587 cve-icon cve-icon
https://git.kernel.org/stable/c/a0d1693923f41d6f49083aa2446686aed09d1d79 cve-icon cve-icon
https://git.kernel.org/stable/c/c151daba0ceb1fb068a215b07de89fb1eb5f87bc cve-icon cve-icon
https://git.kernel.org/stable/c/c68557a49e960dbcdede22c7a9b488603078b8b4 cve-icon cve-icon
https://git.kernel.org/stable/c/f6e3cc296372accad4ee57405195021231ef4bcb cve-icon cve-icon
History

Fri, 04 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp_unpack_cookie() skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing association, Section 5.2.4 permits an expired State Cookie only when both Verification Tags in the cookie match the current association. Otherwise, the packet SHOULD be discarded and a Stale Cookie ERROR MUST be sent. The broad check lets an expired Action A restart cookie reach sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second cookie lifetime, replaying such a cookie after 65 seconds returned a COOKIE-ACK and restarted the association. Check cookie expiration unless both Verification Tags match. This preserves the Action D exception for a lost COOKIE ACK while rejecting expired cookies in all other cases.
Title sctp: reject stale cookies with mismatched verification tags
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T17:11:06.742Z

Updated: 2026-09-04T17:11:06.742Z

Reserved: 2026-08-26T14:34:25.799Z

Link: CVE-2026-80890

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T18:17:57.077

Modified: 2026-09-04T18:17:57.077

Link: CVE-2026-80890

cve-icon Redhat

No data.