Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) subsystem contains a validation bypass in TCP cookie generation helpers used for SYN flood protection. An attacker exploiting this could bypass security checks in network packet processing, potentially allowing unauthorized TCP connection establishment or denial-of-service attacks on systems running vulnerable kernel versions.
Technical details
The vulnerability is a missing validation check in the BPF helper functions bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie in net/core/filter.c. These functions accept a socket pointer with type ARG_PTR_TO_BTF_ID_SOCK_COMMON but access sk->sk_protocol (a full socket field) without first validating that the socket represents a full TCP socket rather than a mini-socket. The fix reorders the validation logic to check sk_state != TCP_LISTEN before accessing sk_protocol, since mini-sockets are never in the TCP_LISTEN state. This prevents dereferencing fullsock-specific fields on inappropriate socket types. A local or network-based attacker with the ability to load and execute eBPF programs could trigger this vulnerability.
Affected products
- Linux Linux kernel Multiple versions prior to patched releases (including 4.x, 5.x, 6.x series)
Timeline
- 2026-09-03: disclosed: CVE-2026-80738 published
- 2026-08-05: patched: Fix committed to kernel tree (upstream commit 31a420a822ff92e2090bd5d65efe8e34e2d6d9b8)