UBUNTU-CVE-2026-80738: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: Check skstate before skprotocol in bpftcpsyncookie bpftcpgensyncookie and bpftcpchecksyncookie accept a socket pointer 'sk' with argument type ARGPTRTOBTFIDSOCKCOMMON. However, they access sk->skprotocol without validating whether 'sk' represents a full socket. Fix this issue by checking sk->skstate != TCPLISTEN before inspecting sk->skprotocol in both bpftcpgensyncookie and bpftcpchecksyncookie. Since mini-sockets are never in the TCPLISTEN state, the condition short-circuits and prevents dereferencing fullsock-specific fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie, check sk->sk_state != TCP_LISTEN before inspecting or dereferencing sk->sk_protocol, preventing access to full-socket-specific fields for mini-sockets.
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates local attack access and low privileges are required. No user interaction is required.
Which Ubuntu kernel flavors should be prioritized for triage?
The affected software list includes ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp-fips, and ubuntu/linux-realtime.
What is the potential security impact if exploited?
The supplied CVSS vector rates confidentiality and integrity impact as high and availability impact as low. The overall severity is high, with a score of 7.3.
How can I determine whether my system is affected?
Identify the installed Ubuntu kernel flavor and compare it with the listed affected software. The provided data does not include affected or fixed version ranges, so it cannot establish patch status for a specific installed kernel version.