{"id":"CVE-2026-80714","state":"PUBLISHED","title":"ipvs: do not propagate one-packet flag to synced conns","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: do not propagate one-packet flag to synced conns\n\nSynced connections can be created before their destination exists. When\nthe destination is later added, ip_vs_bind_dest() copies connection flags\nfrom the destination into cp->flags.\n\nIP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced\nconnection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,\nexpiry can treat it as a one-packet connection and skip unlinking the\nexisting conn_tab node, leaving stale hash nodes pointing at a freed\nstruct ip_vs_conn.\n\nDrop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced\nconnections.","publishedAt":"2026-08-28T06:53:13.069Z","updatedAt":"2026-10-16T19:26:34.808Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"06d1d9b56ef8132fbf85006885eb43d9510b8b02","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"acbdc276091b308ca7794acb86e761f8203e2f59","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"300348e3ba1521b003d59825f97e24f9a6859688","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"44af98cc7d5ef8e730488d5df1eecd5deeaa5947","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"4649e6faeecdc2d44bfa6ccbe405eef27e55d816","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"b5ee5b266f833601ac4817f6df0bc496fc376a28","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"e7acfc990c29890c883d0d0ce3f737d003a43b44","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/ipvs/ip_vs_conn.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.36","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.36","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.151","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.103","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/ipvs/ip_vs_conn.c"]}],"references":["https://git.kernel.org/stable/c/06d1d9b56ef8132fbf85006885eb43d9510b8b02","https://git.kernel.org/stable/c/acbdc276091b308ca7794acb86e761f8203e2f59","https://git.kernel.org/stable/c/300348e3ba1521b003d59825f97e24f9a6859688","https://git.kernel.org/stable/c/44af98cc7d5ef8e730488d5df1eecd5deeaa5947","https://git.kernel.org/stable/c/4649e6faeecdc2d44bfa6ccbe405eef27e55d816","https://git.kernel.org/stable/c/b5ee5b266f833601ac4817f6df0bc496fc376a28","https://git.kernel.org/stable/c/e7acfc990c29890c883d0d0ce3f737d003a43b44","https://git.kernel.org/stable/c/a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/80xxx/CVE-2026-80714.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80714","state":"PUBLISHED","datePublished":"2026-08-28T06:53:13.069Z","dateUpdated":"2026-10-16T19:26:34.808Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-26T14:34:25.788Z"},"containers":{"cna":{"title":"ipvs: do not propagate one-packet flag to synced conns","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: do not propagate one-packet flag to synced conns\n\nSynced connections can be created before their destination exists. When\nthe destination is later added, ip_vs_bind_dest() copies connection flags\nfrom the destination into cp->flags.\n\nIP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced\nconnection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,\nexpiry can treat it as a one-packet connection and skip unlinking the\nexisting conn_tab node, leaving stale hash nodes pointing at a freed\nstruct ip_vs_conn.\n\nDrop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced\nconnections."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"06d1d9b56ef8132fbf85006885eb43d9510b8b02","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"acbdc276091b308ca7794acb86e761f8203e2f59","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"300348e3ba1521b003d59825f97e24f9a6859688","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"44af98cc7d5ef8e730488d5df1eecd5deeaa5947","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"4649e6faeecdc2d44bfa6ccbe405eef27e55d816","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"b5ee5b266f833601ac4817f6df0bc496fc376a28","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"e7acfc990c29890c883d0d0ce3f737d003a43b44","versionType":"git"},{"version":"26ec037f9841e49cc5c615deb8e1e73e5beab2ca","status":"affected","lessThan":"a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/ipvs/ip_vs_conn.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.36","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.36","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.151","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.103","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.44","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/netfilter/ipvs/ip_vs_conn.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/06d1d9b56ef8132fbf85006885eb43d9510b8b02"},{"url":"https://git.kernel.org/stable/c/acbdc276091b308ca7794acb86e761f8203e2f59"},{"url":"https://git.kernel.org/stable/c/300348e3ba1521b003d59825f97e24f9a6859688"},{"url":"https://git.kernel.org/stable/c/44af98cc7d5ef8e730488d5df1eecd5deeaa5947"},{"url":"https://git.kernel.org/stable/c/4649e6faeecdc2d44bfa6ccbe405eef27e55d816"},{"url":"https://git.kernel.org/stable/c/b5ee5b266f833601ac4817f6df0bc496fc376a28"},{"url":"https://git.kernel.org/stable/c/e7acfc990c29890c883d0d0ce3f737d003a43b44"},{"url":"https://git.kernel.org/stable/c/a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - The bug is reached on IPVS backup nodes processing UDP sync datagrams in ip_vs_process_message()/ip_vs_proc_conn() (default multicast 224.0.0.81:8848), and on internet-facing load balancers client UDP traffic drives master sync that creates the hashed backup connection before destination bind.\nAC:L - An attacker can reliably inject or refresh IPVS sync records for UDP connections whose destination is not yet present, then trigger ip_vs_try_bind_dest() once a ONEPACKET destination exists; only optional syncid filtering (often 0) is outside attacker control, and connection expiry is timer-driven without a race.\nPR:N - The backup sync receiver accepts unauthenticated UDP multicast with no capability checks in ip_vs_receive()/ip_vs_process_message(); configuring IPVS/ONEPACKET is an environmental precondition on HA load balancers, not a privilege the remote attacker must hold on the victim host.\nUI:N - Exploitation requires no victim or administrator action at trigger time beyond normal HA IPVS operation; forged or reflected sync traffic and subsequent connection expiry directly invoke the vulnerable bind/unlink path without user interaction.\nS:U - Impact is confined to the kernel IPVS connection table on the affected load-balancer node (stale hash entries to a freed struct ip_vs_conn); it does not cross a VM, container, or IOMMU security boundary.\nC:H - Incorrect ONE_PACKET handling leaves hashed conn_tab nodes pointing at a freed struct ip_vs_conn; subsequent lookups in __ip_vs_conn_in_get() dereference freed slab memory, giving a use-after-free read primitive and potential kernel pointer/data disclosure.\nI:H - The same use-after-free lets attackers influence reuse of the freed ip_vs_conn object and corrupt connection state during later hash-table operations, enabling memory corruption exploitable for arbitrary kernel writes or control-flow hijacking.\nA:H - Dereferencing stale conn_tab entries for a freed connection causes kernel oops/panic; the condition is repeatable by sending additional sync traffic to recreate and expire affected UDP synced connections on the backup node."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-29T06:22:30.808Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.6.151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.12.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.36","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-80714","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:20:40.726937Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:26:34.808Z"}}]}}}