CVE-2026-80738
- Source
- https://cve.org/CVERecord?id=CVE-2026-80738
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80738.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-80738
- Downstream
- Published
- 2026-09-03T08:21:53.143Z
- Modified
- 2026-09-05T03:48:34.713160217Z
- Severity
-
- 7.3 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L CVSS Calculator
- Summary
- bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bpf: Check skstate before skprotocol in bpftcp*_syncookie
bpftcpgensyncookie and bpftcpchecksyncookie accept a socket pointer 'sk' with argument type ARGPTRTOBTFIDSOCKCOMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket.
Fix this issue by checking sk->skstate != TCPLISTEN before inspecting sk->skprotocol in both bpftcpgensyncookie and bpftcpchecksyncookie. Since mini-sockets are never in the TCPLISTEN state, the condition short-circuits and prevents dereferencing fullsock-specific fields.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80738.json" }- References
-
- https://git.kernel.org/stable/c/23f682083aa3fbc0c49667818efd6979a8bc5ac2
- https://git.kernel.org/stable/c/31a420a822ff92e2090bd5d65efe8e34e2d6d9b8
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80738.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-80738
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git