CVE-2026-80738

In the Linux kernel's BPF subsystem, the helper functions bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer typed as a generic 'sock_common' but read sk->sk_protocol without first verifying that the pointer is a full socket rather than a mini-socket (request_sock), causing fullsock-specific fields to be dereferenced on the wrong structure. The flaw is triggered when a loaded BPF program (for example an XDP/TC or socket-lookup program using the TCP SYN cookie helpers) passes a socket handle for a connection in the SYN-acknowledged/mini-socket state into these helpers, leading to an invalid memory access in kernel context. An attacker able to drive traffic through such a BPF program can potentially crash the kernel (denial of service) or cause kernel memory exposure/corruption; the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) rates confidentiality and integrity impact high and availability impact low, for a 7.3 (High) score. Affected are systems running Linux kernels that include these BPF helpers, particularly hosts running BPF programs that call them; no specific vulnerable or fixed version ranges were provided in the source data. Exploitation status: no public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.1% (2nd percentile), so it is not known to be exploited in the wild.

What to do: Apply the mainline kernel patch for CVE-2026-80738 when it is incorporated into your distribution's stable kernel updates (no fixed version numbers were provided in the source data, so track your vendor's advisory). As an interim measure, inventory hosts running BPF programs that call bpf_tcp_gen_syncookie or bpf_tcp_check_syncookie (e.g., XDP/TC SYN-cookie or socket-lookup programs) and prioritize them for patching or temporarily unload those programs; no other workaround is described in the available data.