---
id: CVE-2026-80890
title: 'sctp: reject stale cookies with mismatched verification tags'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sctp: reject stale cookies with mismatched verification tags

  sctp_unpack_cookie() skips cookie expiration checks whenever an
  association already exists.  This is broad…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    f6e3cc296372accad4ee57405195021231ef4bcb
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    c151daba0ceb1fb068a215b07de89fb1eb5f87bc
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    817cffdbdbdf50e1f2b016599d1897de3ca54964
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    61baa5020b0afb41bfd97f8f6ce5e336c4a4546e
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    c68557a49e960dbcdede22c7a9b488603078b8b4
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    a0d1693923f41d6f49083aa2446686aed09d1d79
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    35c279113498d19a8734e2aae67b951b9b20f634
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    9d8da8e0a9bce4a340af60dd0446bc7eb8d07587
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:04:30.492477Z'
published: '2026-09-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:56.077Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80890'
references:
  - url: 'https://git.kernel.org/stable/c/f6e3cc296372accad4ee57405195021231ef4bcb'
  - url: 'https://git.kernel.org/stable/c/c151daba0ceb1fb068a215b07de89fb1eb5f87bc'
  - url: 'https://git.kernel.org/stable/c/817cffdbdbdf50e1f2b016599d1897de3ca54964'
  - url: 'https://git.kernel.org/stable/c/61baa5020b0afb41bfd97f8f6ce5e336c4a4546e'
  - url: 'https://git.kernel.org/stable/c/c68557a49e960dbcdede22c7a9b488603078b8b4'
  - url: 'https://git.kernel.org/stable/c/a0d1693923f41d6f49083aa2446686aed09d1d79'
  - url: 'https://git.kernel.org/stable/c/35c279113498d19a8734e2aae67b951b9b20f634'
  - url: 'https://git.kernel.org/stable/c/9d8da8e0a9bce4a340af60dd0446bc7eb8d07587'
tags:
  - cve.org
epss: 0.00183
epssPercentile: 0.07965
ingestedAt: '2026-11-06T18:00:12.528Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sctp: reject stale cookies with mismatched verification tags

sctp_unpack_cookie() skips cookie expiration checks whenever an
association already exists.  This is broader than the exception in
RFC 9260 Section 5.2.4.

For an existing association, Section 5.2.4 permits an expired State
Cookie only when both Verification Tags in the cookie match the current
association.  Otherwise, the packet SHOULD be discarded and a Stale
Cookie ERROR MUST be sent.

The broad check lets an expired Action A restart cookie reach
sctp_sf_do_dupcook_a().  In a runtime test with the default 60 second
cookie lifetime, replaying such a cookie after 65 seconds returned a
COOKIE-ACK and restarted the association.

Check cookie expiration unless both Verification Tags match.  This
preserves the Action D exception for a lost COOKIE ACK while rejecting
expired cookies in all other cases.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < f6e3cc296372accad4ee57405195021231ef4bcb`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c151daba0ceb1fb068a215b07de89fb1eb5f87bc`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 817cffdbdbdf50e1f2b016599d1897de3ca54964`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 61baa5020b0afb41bfd97f8f6ce5e336c4a4546e`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < c68557a49e960dbcdede22c7a9b488603078b8b4`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < a0d1693923f41d6f49083aa2446686aed09d1d79`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 35c279113498d19a8734e2aae67b951b9b20f634`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.