Linux Kernel CVE-2026-80738

Exploitation requires local access to the target system and the ability to load and attach BPF programs, which demands CAP_BPF or CAP_NET_ADMIN - capabilities unavailable to ordinary unprivileged users on default Linux configurations. The attacker must attach the BPF program to a hook where the runtime can supply a sock_common mini-socket to the syncookie helpers, and must specifically supply a non-listening mini-socket rather than a full TCP_LISTEN-state socket (which the fix's short-circuit correctly handles). Systems with kernel.unprivileged_bpf_disabled=1 are not reachable via this path. Container environments that grant CAP_NET_ADMIN to workloads without restricting BPF helper access represent the primary realistic exposure scenario.

Real-world exploitation risk is moderate despite the 7.3 base score. The local attack vector (AV:L) combined with the requirement for CAP_BPF or CAP_NET_ADMIN narrows the attacker population considerably - even a mid-sized municipal IT team in malbork running Linux-based infrastructure faces exposure only from privileged local processes, misconfigured containers, or attackers who have already escalated to capability-holding accounts. EPSS at 0.20% (10th percentile) is consistent with this constraint and argues against imminent opportunistic exploitation. No CISA KEV listing exists and no public POC has been identified at time of analysis. The C:H/I:H CVSS impact is the primary driver of concern: a successful exploit achieves kernel memory read and potential write primitives, which is serious in environments where BPF capabilities are broadly delegated - for instance, Kubernetes nodes granting CAP_NET_ADMIN to sidecars, or eBPF-based observability stacks running under a low-trust service account. Environments enforcing kernel.unprivileged_bpf_disabled=1 are not exposed via this path.

A local attacker holding CAP_BPF - for example, an eBPF-instrumented microservice in a Kubernetes pod with overly broad security context - loads a crafted BPF program attached to a network receive hook, then calls bpf_tcp_gen_syncookie or bpf_tcp_check_syncookie while supplying a mini-socket (sock_common) rather than a full listening socket. The kernel reads sk->sk_protocol at an offset valid only for a full sock struct, exposing adjacent kernel struct data or producing a corruptible write primitive depending on alignment. No public POC exists, so exploitation requires original kernel exploit development beyond the published patch diff.