Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-80890: Linux kernel may accept expired SCTP connection cookies

CVE-2026-80890 · published 2 months ago
Summary

The Linux kernel's SCTP networking code could mistakenly accept a connection request that is older than the allowed time limit. This can let an attacker replay a stale cookie and re‑establish a network session after it should have expired. Updating the kernel to the latest version fixes the check, so apply the current Linux updates as soon as possible.

What to do
  • Update debian linux to version 6.12.105-1.
  • Update debian linux to version 7.1.8-1.
  • Update debian linux to version 6.1.187-1.
  • Update debian linux-6.12 to version 6.12.107-1~deb12u1.
  • Update bellsoft linux-lts to version 6.1.189-r0.
  • Update bellsoft linux-lts to version 6.12.103-r0.
  • Update bellsoft linux-lts to version 6.18.46-r0.
  • Update canonical linux-aws-5.15 to version 5.15.0-1117.124~20.04.1.
  • Update canonical linux-azure-5.15 to version 5.15.0-1123.132~20.04.1.
  • Update canonical linux-azure-fde-5.15 to version 5.15.0-1122.131~20.04.1.
  • Update canonical linux-gcp-5.15 to version 5.15.0-1118.128~20.04.1.
  • Update canonical linux-hwe-5.15 to version 5.15.0-198.208~20.04.1.
  • Update canonical linux-ibm-5.15 to version 5.15.0-1111.115~20.04.1.
  • Update canonical linux-intel-iotg-5.15 to version 5.15.0-1112.118~20.04.1.
  • Update canonical linux-lowlatency-hwe-5.15 to version 5.15.0-195.205~20.04.1.
  • Update canonical linux-oracle-5.15 to version 5.15.0-1114.120~20.04.1.
  • Update canonical linux to version 5.15.0-198.208.
  • Update canonical linux-aws to version 5.15.0-1117.124.
  • Update canonical linux-azure to version 5.15.0-1123.132.
  • Update canonical linux-gcp to version 5.15.0-1118.128.
  • Update canonical linux-gke to version 5.15.0-1113.119.
  • Update canonical linux-gkeop to version 5.15.0-1100.108.
  • Update canonical linux-ibm to version 5.15.0-1111.115.
  • Update canonical linux-intel-iotg to version 5.15.0-1112.118.
  • Update canonical linux-kvm to version 5.15.0-1109.114.
  • Update canonical linux-lowlatency to version 5.15.0-195.205.
  • Update canonical linux-oracle to version 5.15.0-1114.120.
  • Update canonical linux-xilinx-zynqmp to version 5.15.0-1080.84.
  • Update canonical linux-intel-iot-realtime to version 5.15.0-1109.111.
  • Update canonical linux-realtime to version 5.15.0-1116.125.
  • Update canonical linux-aws-fips to version 5.15.0-1117.124+fips1.
  • Update canonical linux-azure-fips to version 5.15.0-1123.132+fips1.
  • Update canonical linux-fips to version 5.15.0-198.208+fips1.
  • Update canonical linux-gcp-fips to version 5.15.0-1118.128+fips1.
  • Update canonical linux-nvidia to version 5.15.0-1112.113.
  • Update linux linux to version f6e3cc296372accad4ee57405195021231ef4bcb or later.
Affected software
Ecosystem VendorProductAffected versions
– linux linux < f6e3cc296372accad4ee57405195021231ef4bcb
2.6.12
Debian:12 debian linux < 6.1.187-1
Fix: upgrade to 6.1.187-1
Debian:13 debian linux < 6.12.105-1
Fix: upgrade to 6.12.105-1
Debian:14 debian linux < 7.1.8-1
Fix: upgrade to 7.1.8-1
Ubuntu:Pro:14.04:LTS canonical linux All versions
Ubuntu:Pro:14.04:LTS canonical linux-aws All versions
Ubuntu:Pro:14.04:LTS canonical linux-azure All versions
Ubuntu:Pro:14.04:LTS canonical linux-lts-xenial All versions
Ubuntu:Pro:16.04:LTS canonical linux-aws-hwe All versions
Ubuntu:Pro:16.04:LTS canonical linux-gcp All versions
Ubuntu:Pro:16.04:LTS canonical linux-hwe All versions
Ubuntu:16.04:LTS canonical linux-hwe-edge All versions
Ubuntu:Pro:16.04:LTS canonical linux-kvm All versions
Ubuntu:Pro:16.04:LTS canonical linux-oracle All versions
Ubuntu:Pro:FIPS:16.04:LTS canonical linux-fips All versions
Ubuntu:18.04:LTS canonical linux-aws-5.0 All versions
Ubuntu:18.04:LTS canonical linux-aws-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-aws-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-azure-4.15 All versions
Ubuntu:18.04:LTS canonical linux-azure-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-azure-5.4 All versions
Ubuntu:18.04:LTS canonical linux-azure-edge All versions
Ubuntu:Pro:18.04:LTS canonical linux-gcp-4.15 All versions
Ubuntu:18.04:LTS canonical linux-gcp-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-gcp-5.4 All versions
Ubuntu:18.04:LTS canonical linux-gke-4.15 All versions
Ubuntu:18.04:LTS canonical linux-gke-5.4 All versions
Ubuntu:18.04:LTS canonical linux-gkeop-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-hwe-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-ibm-5.4 All versions
Ubuntu:18.04:LTS canonical linux-oem All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.0 All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-oracle-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-raspi-5.4 All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-aws-fips All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-azure-fips All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-gcp-fips All versions
Ubuntu:20.04:LTS canonical linux-aws-5.11 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-aws-5.15 < 5.15.0-1117.124~20.04.1
Fix: upgrade to 5.15.0-1117.124~20.04.1
Ubuntu:20.04:LTS canonical linux-aws-5.8 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.11 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-azure-5.15 < 5.15.0-1123.132~20.04.1
Fix: upgrade to 5.15.0-1123.132~20.04.1
Ubuntu:20.04:LTS canonical linux-azure-5.8 All versions
Ubuntu:20.04:LTS canonical linux-azure-fde All versions
Ubuntu:Pro:20.04:LTS canonical linux-azure-fde-5.15 < 5.15.0-1122.131~20.04.1
Fix: upgrade to 5.15.0-1122.131~20.04.1
Ubuntu:Pro:20.04:LTS canonical linux-bluefield All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.11 All versions
Showing 50 of 192. Show the rest
Ecosystem VendorProductAffected versions
Ubuntu:20.04:LTS canonical linux-gcp-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-gcp-5.15 < 5.15.0-1118.128~20.04.1
Fix: upgrade to 5.15.0-1118.128~20.04.1
Ubuntu:20.04:LTS canonical linux-gcp-5.8 All versions
Ubuntu:20.04:LTS canonical linux-gke All versions
Ubuntu:20.04:LTS canonical linux-gke-5.15 All versions
Ubuntu:20.04:LTS canonical linux-gkeop All versions
Ubuntu:20.04:LTS canonical linux-gkeop-5.15 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.11 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-hwe-5.15 < 5.15.0-198.208~20.04.1
Fix: upgrade to 5.15.0-198.208~20.04.1
Ubuntu:20.04:LTS canonical linux-hwe-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-ibm All versions
Ubuntu:Pro:20.04:LTS canonical linux-ibm-5.15 < 5.15.0-1111.115~20.04.1
Fix: upgrade to 5.15.0-1111.115~20.04.1
Ubuntu:20.04:LTS canonical linux-intel-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-intel-iotg-5.15 < 5.15.0-1112.118~20.04.1
Fix: upgrade to 5.15.0-1112.118~20.04.1
Ubuntu:Pro:20.04:LTS canonical linux-iot All versions
Ubuntu:Pro:20.04:LTS canonical linux-lowlatency-hwe-5.15 < 5.15.0-195.205~20.04.1
Fix: upgrade to 5.15.0-195.205~20.04.1
Ubuntu:Pro:20.04:LTS canonical linux-nvidia-tegra-5.15 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.10 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.13 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.14 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.6 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.11 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-oracle-5.15 < 5.15.0-1114.120~20.04.1
Fix: upgrade to 5.15.0-1114.120~20.04.1
Ubuntu:20.04:LTS canonical linux-oracle-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-raspi All versions
Ubuntu:20.04:LTS canonical linux-raspi2 All versions
Ubuntu:20.04:LTS canonical linux-riscv All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.11 All versions
Ubuntu:Pro:20.04:LTS canonical linux-riscv-5.15 All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-xilinx-zynqmp All versions
Ubuntu:22.04:LTS canonical linux-allwinner-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.2 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.5 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.8 All versions
Ubuntu:22.04:LTS canonical linux-azure-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.2 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.5 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.8 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-6.2 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-6.8 All versions
Ubuntu:22.04:LTS canonical linux-gcp-5.19 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.2 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.5 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.8 All versions
Ubuntu:22.04:LTS canonical linux-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.8 All versions
Ubuntu:22.04:LTS canonical linux-ibm-6.8 All versions
Ubuntu:22.04:LTS canonical linux-intel-iot-realtime All versions
Ubuntu:22.04:LTS canonical linux-intel-iotg < 5.15.0-1112.118
Fix: upgrade to 5.15.0-1112.118
Ubuntu:22.04:LTS canonical linux-lowlatency < 5.15.0-195.205
Fix: upgrade to 5.15.0-195.205
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.8 All versions
Ubuntu:22.04:LTS canonical linux-nvidia < 5.15.0-1112.113
Fix: upgrade to 5.15.0-1112.113
Ubuntu:22.04:LTS canonical linux-nvidia-6.2 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.5 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.8 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-tegra All versions
Ubuntu:22.04:LTS canonical linux-nvidia-tegra-igx All versions
Ubuntu:22.04:LTS canonical linux-oem-5.17 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.0 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.1 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.8 All versions
Ubuntu:22.04:LTS canonical linux-realtime All versions
Ubuntu:22.04:LTS canonical linux-riscv-5.19 All versions
Ubuntu:22.04:LTS canonical linux-riscv-6.5 All versions
Ubuntu:22.04:LTS canonical linux-riscv-6.8 All versions
Ubuntu:22.04:LTS canonical linux-starfive-5.19 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.2 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.5 All versions
Ubuntu:Pro:Realtime:22.04:LTS canonical linux-realtime-6.8 All versions
Ubuntu:24.04:LTS canonical linux-aws-6.14 All versions
Ubuntu:24.04:LTS canonical linux-aws-6.17 All versions
Ubuntu:24.04:LTS canonical linux-aws-7.0 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.11 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.14 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.17 All versions
Ubuntu:24.04:LTS canonical linux-azure-7.0 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde-6.14 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde-6.17 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde-7.0 All versions
Ubuntu:24.04:LTS canonical linux-azure-nvidia All versions
Ubuntu:24.04:LTS canonical linux-azure-nvidia-6.14 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.11 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.14 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.17 All versions
Ubuntu:24.04:LTS canonical linux-gcp-7.0 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.14 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.17 All versions
Ubuntu:24.04:LTS canonical linux-hwe-7.0 All versions
Ubuntu:24.04:LTS canonical linux-lowlatency-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-6.11 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-6.17 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-7.0 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-lowlatency All versions
Ubuntu:24.04:LTS canonical linux-oem-6.11 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.14 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.17 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.8 All versions
Ubuntu:24.04:LTS canonical linux-oracle-6.14 All versions
Ubuntu:24.04:LTS canonical linux-oracle-6.17 All versions
Ubuntu:24.04:LTS canonical linux-oracle-7.0 All versions
Ubuntu:24.04:LTS canonical linux-raspi-realtime All versions
Ubuntu:24.04:LTS canonical linux-riscv-6.14 All versions
Ubuntu:24.04:LTS canonical linux-riscv-6.17 All versions
Ubuntu:24.04:LTS canonical linux-riscv-7.0 All versions
Ubuntu:24.04:LTS canonical linux-xilinx All versions
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime-6.14 All versions
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime-6.17 All versions
Ubuntu:26.04:LTS canonical linux-nvidia-bos All versions
Ubuntu:26.04:LTS canonical linux-oem-7.0 All versions
Debian:12 debian linux-6.12 < 6.12.107-1~deb12u1
Fix: upgrade to 6.12.107-1~deb12u1
Alpaquita:23 bellsoft linux-lts >= 6.1.182-r0, < 6.1.189-r0
Fix: upgrade to 6.1.189-r0
Alpaquita:25 bellsoft linux-lts >= 6.12.95-r0, < 6.12.103-r0
Fix: upgrade to 6.12.103-r0
Alpaquita:stream bellsoft linux-lts >= 6.18.43-r0, < 6.18.46-r0
Fix: upgrade to 6.18.46-r0
Ubuntu:22.04:LTS canonical linux < 5.15.0-198.208
Fix: upgrade to 5.15.0-198.208
Ubuntu:22.04:LTS canonical linux-aws < 5.15.0-1117.124
Fix: upgrade to 5.15.0-1117.124
Ubuntu:22.04:LTS canonical linux-azure < 5.15.0-1123.132
Fix: upgrade to 5.15.0-1123.132
Ubuntu:22.04:LTS canonical linux-gcp < 5.15.0-1118.128
Fix: upgrade to 5.15.0-1118.128
Ubuntu:22.04:LTS canonical linux-gke < 5.15.0-1113.119
Fix: upgrade to 5.15.0-1113.119
Ubuntu:22.04:LTS canonical linux-gkeop < 5.15.0-1100.108
Fix: upgrade to 5.15.0-1100.108
Ubuntu:22.04:LTS canonical linux-ibm < 5.15.0-1111.115
Fix: upgrade to 5.15.0-1111.115
Ubuntu:22.04:LTS canonical linux-kvm < 5.15.0-1109.114
Fix: upgrade to 5.15.0-1109.114
Ubuntu:22.04:LTS canonical linux-oracle < 5.15.0-1114.120
Fix: upgrade to 5.15.0-1114.120
Ubuntu:22.04:LTS canonical linux-xilinx-zynqmp < 5.15.0-1080.84
Fix: upgrade to 5.15.0-1080.84
Ubuntu:Pro:Realtime:22.04:LTS canonical linux-intel-iot-realtime < 5.15.0-1109.111
Fix: upgrade to 5.15.0-1109.111
Ubuntu:Pro:Realtime:22.04:LTS canonical linux-realtime < 5.15.0-1116.125
Fix: upgrade to 5.15.0-1116.125
Ubuntu:Pro:FIPS-updates:22.04:LTS canonical linux-aws-fips < 5.15.0-1117.124+fips1
Fix: upgrade to 5.15.0-1117.124+fips1
Ubuntu:Pro:FIPS-updates:22.04:LTS canonical linux-azure-fips < 5.15.0-1123.132+fips1
Fix: upgrade to 5.15.0-1123.132+fips1
Ubuntu:Pro:FIPS-updates:22.04:LTS canonical linux-fips < 5.15.0-198.208+fips1
Fix: upgrade to 5.15.0-198.208+fips1
Ubuntu:Pro:FIPS-updates:22.04:LTS canonical linux-gcp-fips < 5.15.0-1118.128+fips1
Fix: upgrade to 5.15.0-1118.128+fips1
Original advisory text
BELL-CVE-2026-80890
In the Linux kernel, the following vulnerability has been resolved: sctp: reject stale cookies with mismatched verification tags sctp_unpack_cookie() skips cookie expiration checks whenever an association already exists. This is broader than the exception in RFC 9260 Section 5.2.4. For an existing association, Section 5.2.4 permits an expired State Cookie only when both Verification Tags in the cookie match the current association. Otherwise, the packet SHOULD be discarded and a Stale Cookie ERROR MUST be sent. The broad check lets an expired Action A restart cookie reach sctp_sf_do_dupcook_a(). In a runtime test with the default 60 second cookie lifetime, replaying such a cookie after 65 seconds returned a COOKIE-ACK and restarted the association. Check cookie expiration unless both Verification Tags match. This preserves the Action D exception for a lost COOKIE ACK while rejecting expired cookies in all other cases.
Exploitation
<1% chance of attack within 30 days
Timeline
Published4 Sep 2026
Updated3 Nov 2026
First seen4 Sep 2026
Track software like this
Free during beta