Linux Kernel Vulnerability in SCTP Implementation

CVE-2026-80890

What is CVE-2026-80890?

A vulnerability within the Linux kernel's SCTP implementation allows the acceptance of expired cookies due to inadequate cookie expiration checks when an association is already established. The flawed logic fails to enforce cookie expiration according to RFC 9260 guidelines, permitting improper handling of stale cookies that can potentially restart an association. This vulnerability can lead to significant exposure, allowing replay attacks and unauthorized actions in an SCTP communication environment.

References