CVE-2026-80890 Overview
CVE-2026-80890 affects the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The sctp_unpack_cookie() function skips cookie expiration checks whenever an association already exists. This behavior is broader than the exception defined in RFC 9260 Section 5.2.4, which permits an expired State Cookie only when both Verification Tags match the current association.
The overly permissive check allows an expired Action A restart cookie to reach sctp_sf_do_dupcook_a(). Kernel maintainers confirmed a runtime test where replaying a cookie 65 seconds after issuance (with the default 60 second lifetime) returned a COOKIE-ACK and restarted the association.
Critical Impact
Attackers can replay stale SCTP State Cookies with mismatched verification tags to restart existing associations, violating RFC 9260 protocol requirements.
Affected Products
- Linux kernel SCTP subsystem (net/sctp/sm_make_chunk.c)
- Multiple stable kernel branches receiving backports
- Distributions shipping affected upstream kernels
Discovery Timeline
- 2026-09-04 - CVE CVE-2026-80890 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80890
Vulnerability Analysis
The flaw resides in sctp_unpack_cookie(), the routine responsible for validating incoming State Cookies during SCTP association handshakes. RFC 9260 Section 5.2.4 permits accepting an expired State Cookie only in a narrow case: when both Verification Tags in the cookie match the current association. Otherwise, the packet should be discarded and a Stale Cookie ERROR must be sent.
The existing implementation bypassed the expiration check whenever any association matched, regardless of tag values. This wider bypass permits expired Action A restart cookies to reach sctp_sf_do_dupcook_a(), which processes them as legitimate restart requests. Kernel developers demonstrated the issue by replaying a cookie 65 seconds after issuance and receiving a COOKIE-ACK that restarted the association.
Root Cause
The root cause is an incorrect conditional in sctp_unpack_cookie(). Cookie expiration validation was suppressed for any existing association rather than only when both Verification Tags match. This design mismatch with RFC 9260 collapses the Action A restart path and the Action D lost-COOKIE-ACK exception into a single overly broad exemption.
Attack Vector
An attacker positioned to capture SCTP handshake traffic can replay a captured State Cookie after its lifetime expires. If the tags do not match the current association, the kernel should reject the cookie. Instead, it accepts the cookie and restarts the association, disrupting protocol state and potentially enabling session manipulation against services using SCTP such as telecom signaling stacks (Diameter, SIGTRAN) and clustered databases.
The patched behavior enforces expiration checks unless both Verification Tags match, preserving only the Action D exception for a lost COOKIE ACK.
Detection Methods for CVE-2026-80890
Indicators of Compromise
- Unexpected SCTP association restarts on hosts running vulnerable kernels
- COOKIE-ECHO chunks arriving significantly after the configured cookie lifetime (default 60 seconds)
- Duplicate SCTP INIT/COOKIE-ECHO sequences from the same source with mismatched verification tags
Detection Strategies
- Compare running kernel versions against the fixed commits listed in the kernel.org stable tree to identify unpatched systems
- Instrument SCTP tracepoints (trace_sctp_*) or eBPF probes on sctp_unpack_cookie() to log cookie age and tag mismatches
- Correlate packet captures of SCTP endpoints against timestamps of association restarts recorded in /proc/net/sctp/assocs
Monitoring Recommendations
- Enable SNMP-style counters via /proc/net/sctp/snmp and alert on unusual growth in SctpAborteds or restart-related metrics
- Capture SCTP control chunks at network edges facing signaling or clustering traffic for offline replay analysis
- Track kernel dmesg output for SCTP protocol anomalies emitted by patched builds
How to Mitigate CVE-2026-80890
Immediate Actions Required
- Inventory all Linux hosts using SCTP, particularly telecom signaling gateways, WebRTC data channels, and Lustre or clustered storage nodes
- Apply the vendor-supplied kernel update containing the fix from commit 35c27911 and the associated stable backports
- Reboot patched systems to load the corrected sctp_unpack_cookie() implementation
Patch Information
The upstream fix modifies sctp_unpack_cookie() to enforce cookie expiration checks unless both Verification Tags match the existing association. The change was backported across multiple stable branches. Reference commits: 35c2791, 61baa50, 817cffd, 9d8da8e, a0d1693, c151dab, c68557a, and f6e3cc2.
Workarounds
- Where SCTP is not required, unload the sctp kernel module and blacklist it to eliminate the attack surface
- Restrict SCTP traffic at network boundaries to trusted peers using firewall rules or IPsec
- Reduce the SCTP cookie lifetime via sysctl net.sctp.valid_cookie_life to narrow the replay window pending patch deployment
# Disable SCTP where not required
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/disable-sctp.conf
sudo rmmod sctp 2>/dev/null
# Or shorten the cookie validity window (milliseconds)
sudo sysctl -w net.sctp.valid_cookie_life=30000
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.