CVE-2026-80714
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel's IPVS, there is an issue with propagating the one-packet flag to synced connections, which can lead to stale hash entries and use-after-free.
Risk Assessment
This could lead to system crash or potential kernel code execution, posing a serious security risk.
Recommendation
Install the kernel patch that removes the IP_VS_CONN_F_ONE_PACKET flag from destination flags when binding synced connections.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connection flags from the destination into cp->flags. IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed, expiry can treat it as a one-packet connection and skip unlinking the existing conn_tab node, leaving stale hash nodes pointing at a freed struct ip_vs_conn. Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced connections.