3GPP 24.501 v20.0.0 — the document's own text
5.4.2.5 NAS security mode command not accepted by the UE
Taught in 4. Inside TS 24.501, the document at the centre (CT1 — the group that writes what your phone says, overview).
If the security mode command cannot be accepted, the UE shall send a SECURITY MODE REJECT message. The SECURITY MODE REJECT message contains a 5GMM cause that typically indicates one of the following cause values:
#23 UE security capabilities mismatch.
#24 security mode rejected, unspecified.
If the UE detects that the received Replayed UE security capabilities IE has been altered compared to the latest values that the UE sent to the network, the UE shall set the cause value to #23 "UE security capabilities mismatch".
Upon receipt of the SECURITY MODE REJECT message, the AMF shall stop timer T3560. The AMF shall also abort the ongoing procedure that triggered the initiation of the NAS security mode control procedure.
Both the UE and the AMF shall apply the 5G NAS security context in use before the initiation of the security mode control procedure, if any, to protect the SECURITY MODE REJECT message and any other subsequent messages according to the rules in clause 4.4.4 and 4.4.5.