CVE-2026-80738

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check sk state before sk protocol in bpf tcp * syncookie

bpf tcp gen syncookie and bpf tcp check syncookie accept a socket pointer 'sk' with argument type ARG PTR TO BTF ID SOCK COMMON. However, they access sk->sk protocol without validating whether 'sk' represents a full socket.

Fix this issue by checking sk->sk state != TCP LISTEN before inspecting sk->sk protocol in both bpf tcp gen syncookie and bpf tcp check syncookie. Since mini-sockets are never in the TCP LISTEN state, the condition short-circuits and prevents dereferencing fullsock-specific fields.