CVE-2026-80714: ipvs: do not propagate one-packet flag to synced conns
In the Linux kernel, the following vulnerability has been resolved:
ipvs: do not propagate one-packet flag to synced conns
Synced connections can be created before their destination exists. When the destination is later added, ipvsbinddest() copies connection flags from the destination into cp->flags.
IPVSCONNFONEPACKET connections are not synced. If a synced connection inherits IPVSCONNFONEPACKET while it is already hashed, expiry can treat it as a one-packet connection and skip unlinking the existing conntab node, leaving stale hash nodes pointing at a freed struct ipvsconn.
Drop IPVSCONNFONEPACKET from destination flags when binding synced connections.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify the IPVS destination binding path so that when binding a synced connection (dest is later added), IP_VS_CONN_F_ONE_PACKET is not inherited/copied into cp->flags; i.e., ensure the one-packet flag is not propagated to synced conns to prevent stale hash nodes and skipped unlinking.
Linux kernel IPVS (ip_vs_bind_dest/ip_vs_conn) IP_VS_CONN_F_ONE_PACKET propagation to synced connections = Do not set/propagate IP_VS_CONN_F_ONE_PACKET into cp->flags when binding a synced connection
Event History
Frequently Asked Questions
Which IPVS deployments are affected by this issue?
The affected condition involves synchronized IPVS connections that are created before their destination exists. When that destination is later added, the issue occurs if the synchronized connection inherits the IP_VS_CONN_F_ONE_PACKET flag during destination binding.