CVE-2026-80890 in Linux
Summary
by MITRE • 09/04/2026
In the Linux kernel, the following vulnerability has been resolved:
sctp: reject stale cookies with mismatched verification tags
sctp_unpack_cookie() skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4.
For an existing association, Section 5.2.4 permits an expired State Cookie only when both Verification Tags in the cookie match the current association. Otherwise, the packet SHOULD be discarded and a Stale Cookie ERROR MUST be sent.
The broad check lets an expired Action A restart cookie reach sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second cookie lifetime, replaying such a cookie after 65 seconds returned a COOKIE-ACK and restarted the association.
Check cookie expiration unless both Verification Tags match. This preserves the Action D exception for a lost COOKIE ACK while rejecting expired cookies in all other cases.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The Linux kernel implementation of the Stream Control Transmission Protocol (SCTP) contained a logic flaw within the sctp_unpack_cookie function that allowed stale state cookies to be processed under conditions where they should have been rejected. This vulnerability stems from an overly broad exception in the cookie validation logic, which skipped expiration checks whenever an association already existed between endpoints. According to RFC 9260 Section 5.2.4, while expired State Cookies are permitted for existing associations only if both Verification Tags within the cookie match those of the current association, any other scenario requires the packet to be discarded and a Stale Cookie ERROR message sent. The flawed implementation failed to enforce this distinction, effectively treating all cookies with matching or non-matching tags identically regarding expiration status when an active connection was present.
The operational impact of this defect is significant for network security and protocol stability. By allowing expired Action A restart cookies to reach the sctp_sf_do_dupcook_a handler without proper validation, attackers could potentially exploit timing windows to replay old state information. In practical scenarios with default cookie lifetimes set to sixty seconds, an attacker who captures a valid State Cookie can wait until it expires and then attempt to inject it back into the communication stream. If the Verification Tags do not match the current association's expected values, this packet should be rejected immediately. However, due to the vulnerability, such packets were accepted, leading to the generation of a COOKIE-ACK response and an unintended restart of the SCTP association. This behavior undermines the integrity of the connection state and can lead to denial-of-service conditions or unexpected session resets that disrupt ongoing data transfers.
From a technical perspective, this issue is classified under CWE-20 as Improper Input Validation because the system failed to correctly validate input parameters against expected constraints defined by the protocol specification. The failure lies in the conditional logic governing cookie expiration checks, which did not strictly adhere to the RFC requirements for handling stale cookies with mismatched verification tags. This misalignment between implementation and standard allows an adversary to manipulate the state machine of the SCTP stack by exploiting the gap where expiration validation is bypassed based on association existence rather than tag integrity.
To mitigate this vulnerability, it is essential that systems running affected versions of the Linux kernel are updated with patches that correct the sctp_unpack_cookie function logic. The fix involves ensuring that cookie expiration checks are performed unless both Verification Tags in the incoming State Cookie exactly match those of the current active association. This adjustment preserves the necessary exception for Action D scenarios, where a lost COOKIE ACK might require reprocessing, while strictly rejecting expired cookies in all other cases. Administrators should verify their kernel versions and apply vendor-provided security updates to restore compliance with RFC 9260 and prevent potential exploitation of this state manipulation flaw.