CVE-2026-80890

A flaw was found in the Stream Control Transmission Protocol (SCTP) implementation within the Linux kernel. The sctp_unpack_cookie() function incorrectly skips cookie expiration checks when an association already exists. A remote attacker could exploit this by replaying an expired SCTP cookie with mismatched verification tags, potentially causing an existing association to unexpectedly restart.

SCTP cookie unpacking could accept an expired restart State Cookie when an association already existed even if the cookie Verification Tags did not match the current association. A remote peer with a stale cookie could replay it after expiration and cause COOKIE ACK generation and association restart, which can disrupt an existing SCTP association. For the CVSS the PR:N is selected because no local account or authenticated user context is required on the victim, only network reachability to the SCTP endpoint and a usable stale cookie. The issue is network reachable but the attack complexity is high because the attacker needs a suitable stale cookie and the correct association state. Impact is mainly denial of service through association restart and service disruption, with possible high integrity impact in the paranoid interpretation because protocol state can be changed by an expired replayed cookie.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.