sctp: reject stale cookies with mismatched verification tags

published 2026-09-04 2 mo ago modified 2026-11-06 2 d ago also EUVD-2026-71640

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

sctp_unpack_cookie() skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4.

For an existing association, Section 5.2.4 permits an expired State Cookie only when both Verification Tags in the cookie match the current association. Otherwise, the packet SHOULD be discarded and a Stale Cookie ERROR MUST be sent.

The broad check lets an expired Action A restart cookie reach sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second cookie lifetime, replaying such a cookie after 65 seconds returned a COOKIE-ACK and restarted the association.

Check cookie expiration unless both Verification Tags match. This preserves the Action D exception for a lost COOKIE ACK while rejecting expired cookies in all other cases.

Patch / fix

fixed in 1 distros 3 links 8

Linux Linux 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, 7.2

debian ubuntu azure linux

linux Debian 12 6.1.187-1
linux Debian 13 6.12.105-1
linux Debian 14 7.1.8-1
linux-6.12 Debian 12 6.12.107-1~deb12u1

debian advisories DEBIAN-CVE-2026-80890

linux Ubuntu 22.04 LTS 5.15.0-198.208
linux Ubuntu 26.04 LTS 7.0.0-42.42
linux-aws Ubuntu 22.04 LTS 5.15.0-1117.124
linux-aws Ubuntu 26.04 LTS 7.0.0-1016.17
linux-gcp Ubuntu 22.04 LTS 5.15.0-1118.128
linux-gcp Ubuntu 26.04 LTS 7.0.0-1016.18
linux-gke Ubuntu 22.04 LTS 5.15.0-1113.119
linux-ibm Ubuntu 22.04 LTS 5.15.0-1111.115

ubuntu advisories UBUNTU-CVE-2026-80890

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel Azure Linux 3.0 6.6.152.1-1

azure linux advisories AZL-99642

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-80890 updated 2026-11-07 cvss 5.3

kernel: sctp: reject stale cookies with mismatched verification tags

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
affected: workaround, no fix planned “Out of support scope”
Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 d ago (2026-11-06)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Affected products

Linux Linux

Classification

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2026-80890
NVD CVE-2026-80890

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary