Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket. Fix this issue by checking sk->sk_state != TCP_LISTEN before inspecting sk->sk_protocol in both bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie. Since mini-sockets are never in the TCP_LISTEN state, the condition short-circuits and prevents dereferencing fullsock-specific fields.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-03T13:06:12.910Z",
  "pubdate": "2026-09-03T13:06:12.910Z",
  "executiveSummary": "This vulnerability involves an improper validation of socket structures within the Linux kernel BPF subsystem.\nThe flaw specifically affects the bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie helper functions, which fail to verify if a provided socket pointer is a full socket before accessing fields unique to full sockets.\nBy passing a mini-socket, which lacks the structure required for full socket operations, an attacker can trigger a memory dereference error.\nThe primary impact is a potential kernel panic or denial-of-service (DoS) condition.\nThis vulnerability is reachable when BPF programs interact with socket structures using the ARG_PTR_TO_BTF_ID_SOCK_COMMON argument type.\nSuccessful exploitation requires the ability to execute eBPF programs, typically requiring CAP_BPF or CAP_SYS_ADMIN privileges depending on system configuration.\nThe risk is categorized as moderate, primarily threatening system availability through memory corruption or instability.",
  "technicalDetails": "The vulnerability resides in the interaction between the eBPF subsystem and the Linux kernel's networking stack, specifically within the logic handling TCP syncookie operations for BPF programs. The functions bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer defined as ARG_PTR_TO_BTF_ID_SOCK_COMMON. This argument type is broad, encompassing various types of socket representations, including 'full' sockets and 'mini-sockets' (e.g., request sockets or timewait sockets).\nThe root cause of the vulnerability is an unsafe field access pattern. The kernel code attempts to dereference sk->sk_protocol to determine the underlying transport protocol without first verifying if the provided socket structure is a full socket instance. In the Linux kernel networking implementation, full sockets contain the sk_protocol field, whereas mini-sockets do not share this exact memory layout or member definition. Accessing this member on a non-full socket structure leads to an invalid memory access.\nThe exploitation flow begins with the execution of a crafted BPF program. An attacker supplies a mini-socket pointer to the vulnerable BPF helper function. Because the helper does not perform an explicit check to confirm the socket state (specifically if the socket is in the TCP_LISTEN state, which is a property reserved for full sockets), the kernel proceeds to read the memory location corresponding to sk_protocol. Since the mini-socket memory layout differs, this results in an out-of-bounds read or a dereference of an invalid pointer address.\nThis behavior leads to a kernel-level memory corruption event. If the system's memory management detects the invalid access, it will trigger an immediate kernel panic to prevent further instability, successfully achieving a denial-of-service against the host machine. While this flaw is primarily a DoS vector, improper dereferences in the kernel can occasionally be leveraged for more complex exploits if the dereferenced pointer can be controlled or influenced by user-space inputs. The vulnerability is present in kernel versions where these specific BPF helpers support the ARG_PTR_TO_BTF_ID_SOCK_COMMON argument type without state-based validation."
}