Cloudanix VulnDB

CVE-2026-80890

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux network connection handling lets attackers revive old connections that should have timed out, potentially interrupting important network services.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Other
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

SCTP cookie handling skips expiration validation for existing associations beyond the narrow RFC 9260 5.2.4 exception, allowing a stale cookie with mismatched verification tags to reach sctp_sf_do_dupcook_a() and restart the association.

Why it matters to the business

Attackers can force unexpected restarts of SCTP-based network sessions, disrupting reliable transport for applications such as telecom signaling or clustered storage, increasing operational downtime and potential data loss risk in high-availability environments.

How an attack unfolds

An attacker obtains a valid SCTP State Cookie, waits past its 60-second lifetime, then replays it; because the broad existing-association check bypasses expiration, the kernel accepts the cookie, returns COOKIE-ACK, and restarts the association even though verification tags do not match the required condition.

How to fix it

Update the Linux kernel to a version containing the fix that enforces cookie expiration checks unless both verification tags exactly match the current association; rebuild and reboot affected systems or apply the vendor-provided backport.

How to confirm the fix worked

Confirm the patched kernel is running, then replay an expired cookie with mismatched verification tags and verify that a Stale Cookie ERROR is returned instead of COOKIE-ACK; review SCTP association state tables for unexpected restarts.

Typical attack path

  1. Obtain or capture a valid SCTP State Cookie from a prior handshake
  2. Allow the cookie to expire beyond the configured lifetime
  3. Replay the expired cookie toward the listening SCTP endpoint
  4. Receive COOKIE-ACK and observe association restart

How to detect it

Search SCTP stack logs and packet captures for COOKIE-ACK responses triggered by cookies older than the configured lifetime; correlate with association restart events that lack a fresh INIT handshake.

  • COOKIE-ACK sent in response to expired cookie replay
  • sctp_sf_do_dupcook_a called with mismatched verification tags

What your security team should do

  • Prioritize kernel updates on all systems exposing SCTP ports
  • Restrict SCTP traffic to trusted networks via firewall rules where feasible
  • Enable SCTP event logging and monitor for unexpected COOKIE-ACK or association restarts
  • Test failover behavior of SCTP-dependent applications after patching

The record

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp_unpack_cookie() skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing association, Section 5.2.4 permits an expired State Cookie only when both Verification Tags in the cookie match the current association. Otherwise, the packet SHOULD be discarded and a Stale Cookie ERROR MUST be sent. The broad check lets an expired Action A restart cookie reach sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second cookie lifetime, replaying such a cookie after 65 seconds returned a COOKIE-ACK and restarted the association. Check cookie expiration unless both Verification Tags match. This preserves the Action D exception for a lost COOKIE ACK while rejecting expired cookies in all other cases.

Affected packages

Ecosystem Package Introduced Fixed