CVE-2026-80738

bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie

State: Published
Severity: 7.3 High
Published: Sep 3, 2026
Updated: Oct 30, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie

bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket.

Fix this issue by checking sk->sk_state != TCP_LISTEN before inspecting sk->sk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie. Since mini-sockets are never in the TCP_LISTEN state, the condition short-circuits and prevents dereferencing fullsock-specific fields.

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	399040847084a69f345e0a52fd62f04654e0fce3 to before b75f1c071f31be7f4b950721e04240c250091ad4Affected 399040847084a69f345e0a52fd62f04654e0fce3 to before 5702e4c259809c760912c477c4ae34e9217bb4d9Affected 399040847084a69f345e0a52fd62f04654e0fce3 to before b5525e853a2a08a9559adb84b0616025958dc542Affected 399040847084a69f345e0a52fd62f04654e0fce3 to before 22c2169770ad3b3595690e51caac875178cf496dAffected 399040847084a69f345e0a52fd62f04654e0fce3 to before 23f682083aa3fbc0c49667818efd6979a8bc5ac2Affected 399040847084a69f345e0a52fd62f04654e0fce3 to before 31a420a822ff92e2090bd5d65efe8e34e2d6d9b8Affected
LinuxLinux	5.2Affected before 5.2Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

399040847084a69f345e0a52fd62f04654e0fce3 to before b75f1c071f31be7f4b950721e04240c250091ad4Affected
399040847084a69f345e0a52fd62f04654e0fce3 to before 5702e4c259809c760912c477c4ae34e9217bb4d9Affected
399040847084a69f345e0a52fd62f04654e0fce3 to before b5525e853a2a08a9559adb84b0616025958dc542Affected
399040847084a69f345e0a52fd62f04654e0fce3 to before 22c2169770ad3b3595690e51caac875178cf496dAffected
399040847084a69f345e0a52fd62f04654e0fce3 to before 23f682083aa3fbc0c49667818efd6979a8bc5ac2Affected
399040847084a69f345e0a52fd62f04654e0fce3 to before 31a420a822ff92e2090bd5d65efe8e34e2d6d9b8Affected

LinuxLinux

5.2Affected
before 5.2Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.