CVE-2026-80738: bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check skstate before skprotocol in bpftcpsyncookie
bpftcpgensyncookie and bpftcpchecksyncookie accept a socket pointer 'sk' with argument type ARGPTRTOBTFIDSOCKCOMMON. However, they access sk->skprotocol without validating whether 'sk' represents a full socket.
Fix this issue by checking sk->skstate != TCPLISTEN before inspecting sk->skprotocol in both bpftcpgensyncookie and bpftcpchecksyncookie. Since mini-sockets are never in the TCPLISTEN state, the condition short-circuits and prevents dereferencing fullsock-specific fields.
Event History
Frequently Asked Questions
What must an attacker be able to do to reach the vulnerable code?
They must be able to invoke the BPF helpers bpf_tcp_gen_syncookie or bpf_tcp_check_syncookie with a socket pointer accepted as ARG_PTR_TO_BTF_ID_SOCK_COMMON. The provided data does not identify the required BPF program type, privileges, or an external network-only trigger.
What condition makes the socket access unsafe?
The helpers can receive a pointer to a mini-socket rather than a full socket, but they inspect the full-socket-specific sk_protocol field. The fix checks sk_state before sk_protocol; mini-sockets are never in TCP_LISTEN, so the check prevents that dereference.
How can I determine whether a system has the fix?
Check whether the kernel includes either referenced stable commit: 23f682083aa3fbc0c49667818efd6979a8bc5ac2 or 31a420a822ff92e2090bd5d65efe8e34e2d6d9b8. A fixed kernel checks sk_state against TCP_LISTEN before accessing sk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie.