CVE-2026-80738 (GCVE-0-2026-80738)

Vulnerability from cvelistv5 – Published: 2026-09-03 08:21 – Updated: 2026-10-30 12:31
VLAI
Title
bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket. Fix this issue by checking sk->sk_state != TCP_LISTEN before inspecting sk->sk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie. Since mini-sockets are never in the TCP_LISTEN state, the condition short-circuits and prevents dereferencing fullsock-specific fields.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6637 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 399040847084a69f345e0a52fd62f04654e0fce3 , < b75f1c071f31be7f4b950721e04240c250091ad4 (git)
Affected: 399040847084a69f345e0a52fd62f04654e0fce3 , < 5702e4c259809c760912c477c4ae34e9217bb4d9 (git)
Affected: 399040847084a69f345e0a52fd62f04654e0fce3 , < b5525e853a2a08a9559adb84b0616025958dc542 (git)
Affected: 399040847084a69f345e0a52fd62f04654e0fce3 , < 22c2169770ad3b3595690e51caac875178cf496d (git)
Affected: 399040847084a69f345e0a52fd62f04654e0fce3 , < 23f682083aa3fbc0c49667818efd6979a8bc5ac2 (git)
Affected: 399040847084a69f345e0a52fd62f04654e0fce3 , < 31a420a822ff92e2090bd5d65efe8e34e2d6d9b8 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 6.1.191 , ≤ 6.1.* (semver)
Unaffected: 6.6.160 , ≤ 6.6.* (semver)
Unaffected: 6.12.114 , ≤ 6.12.* (semver)
Unaffected: 6.18.57 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b75f1c071f31be7f4b950721e04240c250091ad4",
              "status": "affected",
              "version": "399040847084a69f345e0a52fd62f04654e0fce3",
              "versionType": "git"
            },
            {
              "lessThan": "5702e4c259809c760912c477c4ae34e9217bb4d9",
              "status": "affected",
              "version": "399040847084a69f345e0a52fd62f04654e0fce3",
              "versionType": "git"
            },
            {
              "lessThan": "b5525e853a2a08a9559adb84b0616025958dc542",
              "status": "affected",
              "version": "399040847084a69f345e0a52fd62f04654e0fce3",
              "versionType": "git"
            },
            {
              "lessThan": "22c2169770ad3b3595690e51caac875178cf496d",
              "status": "affected",
              "version": "399040847084a69f345e0a52fd62f04654e0fce3",
              "versionType": "git"
            },
            {
              "lessThan": "23f682083aa3fbc0c49667818efd6979a8bc5ac2",
              "status": "affected",
              "version": "399040847084a69f345e0a52fd62f04654e0fce3",
              "versionType": "git"
            },
            {
              "lessThan": "31a420a822ff92e2090bd5d65efe8e34e2d6d9b8",
              "status": "affected",
              "version": "399040847084a69f345e0a52fd62f04654e0fce3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.191",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.191",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie\n\nbpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer\n\u0027sk\u0027 with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access\nsk-\u003esk_protocol without validating whether \u0027sk\u0027 represents a full socket.\n\nFix this issue by checking sk-\u003esk_state != TCP_LISTEN before inspecting\nsk-\u003esk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie.\nSince mini-sockets are never in the TCP_LISTEN state, the condition\nshort-circuits and prevents dereferencing fullsock-specific fields."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in bpf_tcp_gen_syncookie/bpf_tcp_check_syncookie BPF helpers invoked only from locally loaded and attached TC clsact or XDP programs via bpf(); per kernel CNA guidance BPF/tc paths are Local even when later triggered by ingress packets.\nAC:L - An attacker who loads the BPF program fully controls passing bpf_skc_lookup_tcp() results (request_sock/TCP_NEW_SYN_RECV or timewait sockets) into the syncookie helpers and can reliably trigger the bad sk_protocol read with crafted SYN/ACK traffic; no uncontrollable races or rare layout are required.\nPR:L - Exploitation requires bpf(BPF_PROG_LOAD) (CAP_BPF, obtainable in user namespaces) plus attaching TC/XDP hooks (CAP_NET_ADMIN via unshare -Urn); no init-namespace root is needed, matching CNA guidance for namespace-reachable net/BPF capabilities.\nUI:N - No victim mount, login, or cooperative action is required; once the attacker loads and attaches their BPF program, sending network packets from their own processes deterministically reaches the vulnerable helper on each matching lookup.\nS:U - Impact is confined to kernel heap disclosure/type confusion within the host kernel security domain; it does not cross VM, container runtime, IOMMU, or other security-authority boundaries.\nC:H - Casting a mini-socket to struct sock and reading sk_protocol performs a fixed-offset out-of-bounds read (~300+ bytes past request_sock/inet_timewait_sock) into adjacent slab memory, leaking kernel heap contents including pointers usable for further local exploitation.\nI:H - This is type confusion between ARG_PTR_TO_BTF_ID_SOCK_COMMON mini-sockets and full struct sock fields; per CNA guidance type confusion is rated High integrity impact even though the immediate bug is a read, because mis-typed socket pointers corrupt the kernel\u0027s object model.\nA:L - The primary impact is information disclosure; while the out-of-bounds u16 read usually stays within the slab page, reads near allocation boundaries or under KASAN can fault and oops the kernel, giving at least Low availability impact when uncertain."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T12:31:02.208Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b75f1c071f31be7f4b950721e04240c250091ad4"
        },
        {
          "url": "https://git.kernel.org/stable/c/5702e4c259809c760912c477c4ae34e9217bb4d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5525e853a2a08a9559adb84b0616025958dc542"
        },
        {
          "url": "https://git.kernel.org/stable/c/22c2169770ad3b3595690e51caac875178cf496d"
        },
        {
          "url": "https://git.kernel.org/stable/c/23f682083aa3fbc0c49667818efd6979a8bc5ac2"
        },
        {
          "url": "https://git.kernel.org/stable/c/31a420a822ff92e2090bd5d65efe8e34e2d6d9b8"
        }
      ],
      "title": "bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80738",
    "datePublished": "2026-09-03T08:21:53.143Z",
    "dateReserved": "2026-08-26T14:34:25.789Z",
    "dateUpdated": "2026-10-30T12:31:02.208Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80738",
      "date": "2026-11-05",
      "epss": "0.00171",
      "percentile": "0.06562"
    },
    "microsoft_vex": {
      "current_release_date": "2026-11-01T15:09:44.000Z",
      "cve": "CVE-2026-80738",
      "id": "msrc_CVE-2026-80738",
      "initial_release_date": "2026-09-04T01:06:21.000Z",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80738.json",
      "version": "5"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/filter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b75f1c071f31be7f4b950721e04240c250091ad4",
                    "status": "affected",
                    "version": "399040847084a69f345e0a52fd62f04654e0fce3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5702e4c259809c760912c477c4ae34e9217bb4d9",
                    "status": "affected",
                    "version": "399040847084a69f345e0a52fd62f04654e0fce3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b5525e853a2a08a9559adb84b0616025958dc542",
                    "status": "affected",
                    "version": "399040847084a69f345e0a52fd62f04654e0fce3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "22c2169770ad3b3595690e51caac875178cf496d",
                    "status": "affected",
                    "version": "399040847084a69f345e0a52fd62f04654e0fce3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "23f682083aa3fbc0c49667818efd6979a8bc5ac2",
                    "status": "affected",
                    "version": "399040847084a69f345e0a52fd62f04654e0fce3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "31a420a822ff92e2090bd5d65efe8e34e2d6d9b8",
                    "status": "affected",
                    "version": "399040847084a69f345e0a52fd62f04654e0fce3",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/filter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.2"
                  },
                  {
                    "lessThan": "5.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.191",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.160",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.114",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.57",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie\n\nbpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer\n\u0027sk\u0027 with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access\nsk-\u003esk_protocol without validating whether \u0027sk\u0027 represents a full socket.\n\nFix this issue by checking sk-\u003esk_state != TCP_LISTEN before inspecting\nsk-\u003esk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie.\nSince mini-sockets are never in the TCP_LISTEN state, the condition\nshort-circuits and prevents dereferencing fullsock-specific fields."
          }
        ],
        "id": "CVE-2026-80738",
        "lastModified": "2026-10-30T13:20:10.940",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-03T13:06:12.910",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/22c2169770ad3b3595690e51caac875178cf496d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/23f682083aa3fbc0c49667818efd6979a8bc5ac2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/31a420a822ff92e2090bd5d65efe8e34e2d6d9b8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5702e4c259809c760912c477c4ae34e9217bb4d9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b5525e853a2a08a9559adb84b0616025958dc542"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b75f1c071f31be7f4b950721e04240c250091ad4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-11-01T08:02:40+00:00",
      "cve": "CVE-2026-80738",
      "id": "CVE-2026-80738",
      "initial_release_date": "2026-09-03T00:00:00+00:00",
      "product_status:known_affected": "237",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80738.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-10-15T14:18:22Z",
      "cve": "CVE-2026-80738",
      "id": "CVE-2026-80738",
      "initial_release_date": "2026-09-03T16:25:20Z",
      "product_status:known_affected": "261",
      "product_status:known_not_affected": "93",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80738",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-80738.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.