Linux SCTP: Fix stale cookie verification tag mismatch in scrp_unpack_cookie

Vulnerability Overview Vulnerability Name: scrp: reject stale cookies with mismatched verification tags Commit Message: commit Committer: Yuxiang Yang Commit Time: 2026-07-22 22:56:23 +0000 Vulnerability Description: - skips the cookie expiration check under certain anomalous conditions. - For existing associations, RFC 9280 Section 3.2.4 stipulates that a stale cookie is accepted only if its verification tag matches the current association; otherwise, the packet should be dropped, and a State Cookie ERROR should be sent to restart the association. - This fix ensures that, under the default 60-second cookie lifetime, a COOKIE-ACK returning after 60 seconds is replayed and the association is restarted. - Resolved an issue present in Linux 2.6.12-rc2. Scope of Impact Affected Version: Linux 2.6.12-rc2 Affected Component: (SCTP protocol stack) Fixed Version: Versions after Linux 2.6.12-rc2 Fix Details Fix Commit: ("Linux 2.6.12-rc2") Fix Content: - Added a check for cookie verification tag matching in . - If the cookie is stale but the verification tag does not match, the packet is dropped and a State Cookie ERROR is sent. - If the cookie is stale but the verification tag matches, the cookie is accepted and the association is restarted. POC/Exploit Code ```c // Post-fix code snippet (from diff) if (assoc->cookie_expiration, kt) { if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_expiration, kt) { kt = ktime_get_real(); } if (t_uscc cookie_ex

Goal Reached Thanks to every supporter — we hit 100%!

Linux SCTP: Fix stale cookie verification tag mismatch in scrp_unpack_cookie