Linux Kernel up to 7.1.8 BPF bpf_tcp_gen_syncookie/bpf_tcp_check_syncookie sk null pointer dereference

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.1.8. It has been classified as problematic. Affected by this issue is the function bpf_tcp_gen_syncookie/bpf_tcp_check_syncookie of the component BPF. The manipulation of the argument sk leads to null pointer dereference. This vulnerability is listed as CVE-2026-80738. The attack must be carried out locally. There is no available exploit.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Linux Kernel up to 7.1.8. This issue affects the function bpf_tcp_gen_syncookie/bpf_tcp_check_syncookie of the component BPF. The manipulation of the argument sk with an unknown input leads to a null pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket. Fix this issue by checking sk->sk_state != TCP_LISTEN before inspecting sk->sk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie. Since mini-sockets are never in the TCP_LISTEN state, the condition short-circuits and prevents dereferencing fullsock-specific fields.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-80738 since 08/26/2026. The exploitation is known to be easy. An attack has to be approached locally. Additional levels of successful authentication are necessary for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 7.1.9 eliminates this vulnerability. Applying the patch 23f682083aa3fbc0c49667818efd6979a8bc5ac2/31a420a822ff92e2090bd5d65efe8e34e2d6d9b8 is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.1.6
• 7.1.7
• 7.1.8

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion