CVE-2026-80738

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) TCP syncookie handling. The bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie functions do not properly validate socket states before accessing protocol-specific information. This oversight could allow an attacker to trigger an invalid memory access, potentially leading to information disclosure or a denial of service.

This vulnerability is rated as Moderate because exploitation requires local administrative privileges, such as the capability to load and attach custom BPF programs, which is restricted by default on Red Hat Enterprise Linux. An attacker with elevated privileges could provide an incompatible socket structure to syncookie BPF helpers, triggering an out-of-bounds field read that results in a kernel crash and system denial of service. Because the flaw cannot be reached remotely or by unprivileged users without specialized capabilities, the overall blast radius is limited.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.