Executive brief
The Linux kernel's SCTP (Stream Control Transmission Protocol) implementation contains a flaw in how it validates expired cookies during connection establishment. An attacker can replay an expired cookie to restart a connection that should have been rejected, potentially allowing unauthorized association restart or state confusion in network protocols that rely on SCTP.
Technical details
The vulnerability exists in the sctp_unpack_cookie() function in net/sctp/sm_make_chunk.c. The code improperly skips cookie expiration checks whenever an association already exists, which is broader than RFC 9260 Section 5.2.4 permits. RFC 9260 only exempts expired State Cookies when both Verification Tags (my_vtag and peer_vtag) in the cookie match the current association. An attacker can exploit this by replaying an expired "Action A restart" cookie after the default 60-second cookie lifetime expires, causing the association to be restarted with a COOKIE-ACK response when it should have been rejected with a Stale Cookie error. The fix adds an explicit check ensuring cookie expiration is validated unless both verification tags match the current association.
Affected products
- Linux Linux kernel All versions since 2.6.12 (affected by original code), fix available from 2026-08-09
Timeline
- 2026-09-04: disclosed
- 2026-08-09: patched: Fix committed upstream and to stable branches