Description
In the Linux kernel, the following vulnerability has been resolved:

ipvs: do not propagate one-packet flag to synced conns

Synced connections can be created before their destination exists. When
the destination is later added, ip_vs_bind_dest() copies connection flags
from the destination into cp->flags.

IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced
connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,
expiry can treat it as a one-packet connection and skip unlinking the
existing conn_tab node, leaving stale hash nodes pointing at a freed
struct ip_vs_conn.

Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced
connections.
Published: 2026-08-28
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability occurs in the IPVS subsystem of the Linux kernel when a synced connection inherits the IP_VS_CONN_F_ONE_PACKET flag from a destination that is added after the connection is created. The copied flag causes the expiry logic to treat the connection as a one‑packet connection and skip unlinking the hash table entry, resulting in a use‑after‑free of the ip_vs_conn structure. This flaw can lead to a kernel crash, causing loss of system availability.

Affected Systems

All builds of the Linux kernel that contain the IPVS module before the patch commit 06d1d9b56ef8132fbf85006885eb43d9510b8b02 are affected. This includes generic kernel releases used by most distributions that have not yet incorporated the fix. Any system running a vulnerable kernel and utilizing IPVS is at risk.

Risk and Exploitability

The CVSS score is not provided, the EPSS score is unavailable, and the vulnerability is not listed in CISA's KEV catalog. Exploitation requires creating a synced connection before its destination is fully configured, causing the use‑after‑free that can crash the kernel. The flaw is local and does not describe a remote attack path. The impact is loss of availability; no escalation route is documented.

Generated by OpenCVE AI on August 28, 2026 at 12:17 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the IPVS patch commit 06d1d9b56ef8132fbf85006885eb43d9510b8b02 or later.
  • Reboot the system or reload the kernel to activate the new code path.
  • If a kernel upgrade cannot be performed immediately, stop or disable the IPVS service to eliminate the vulnerable functionality until the patch is applied.

Generated by OpenCVE AI on August 28, 2026 at 12:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 28 Aug 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Fri, 28 Aug 2026 07:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connection flags from the destination into cp->flags. IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed, expiry can treat it as a one-packet connection and skip unlinking the existing conn_tab node, leaving stale hash nodes pointing at a freed struct ip_vs_conn. Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced connections.
Title ipvs: do not propagate one-packet flag to synced conns
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-28T06:53:13.069Z

Reserved: 2026-08-26T14:34:25.788Z

Link: CVE-2026-80714

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-28T08:16:57.053

Modified: 2026-08-28T08:16:57.053

Link: CVE-2026-80714

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-28T12:30:17Z

Weaknesses