InfoSec Signals™
Sign InStart Free
Back to CVE records
Not yet scoredPublished Sep 4, 2026

CVE-2026-80890sctp: reject stale cookies with mismatched verification tags

Updated under an hour ago ()

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp_unpack_cookie() skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing association, Section 5.2.4 permits an expired State Cookie only when both Verification Tags in the cookie match the current association. Otherwise, the packet SHOULD be discarded and a Stale Cookie ERROR MUST be sent. The broad check lets an expired Action A restart cookie reach sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second cookie lifetime, replaying such a cookie after 65 seconds returned a COOKIE-ACK and restarted the association. Check cookie expiration unless both Verification Tags match. This preserves the Action D exception for a lost COOKIE ACK while rejecting expired cookies in all other cases.

CVSS
Not yet scored
Weakness (CWE)
Not given
Known exploited
Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days)
Not loaded for this CVE
Assigned by
Linux
NVD analysis
Received
Record last updated
Sep 4, 2026
First seen by InfoSec Signals
Oct 9, 2026

Affected products

Affected products
Linux Linux
linux:linux (from the name)
from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f6e3cc296372accad4ee57405195021231ef4bcb; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c151daba0ceb1fb068a215b07de89fb1eb5f87bc; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 817cffdbdbdf50e1f2b016599d1897de3ca54964; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 61baa5020b0afb41bfd97f8f6ce5e336c4a4546e; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c68557a49e960dbcdede22c7a9b488603078b8b4; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a0d1693923f41d6f49083aa2446686aed09d1d79; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 35c279113498d19a8734e2aae67b951b9b20f634; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9d8da8e0a9bce4a340af60dd0446bc7eb8d07587
CNA record

References

References

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.