Cloudanix VulnDB

CVE-2026-80714

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Aug 28, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's network load-balancing feature can let attackers crash servers or potentially take control, and organizations should install the kernel updates now.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in ip_vs_bind_dest() when a synced IPVS connection inherits the IP_VS_CONN_F_ONE_PACKET flag after being hashed, allowing expiry logic to skip unlinking the conn_tab node and leave a stale pointer to a freed ip_vs_conn struct.

Why it matters to the business

Kernel memory corruption or crashes on systems running IPVS connection synchronization for load balancing or high-availability networking; Red Hat Enterprise Linux kernels are affected and require prompt patching due to the 32-day window since disclosure.

How an attack unfolds

An attacker with network access to an IPVS-enabled system creates conditions that generate synced connections before their destinations exist, then adds the destination so the one-packet flag is copied into an already-hashed connection; subsequent expiry treats the entry as one-packet, skips proper unlinking, and leaves a dangling reference that can be dereferenced for memory corruption.

How to fix it

Update to the fixed Red Hat kernel packages: kernel on EL10 to 6.12.0-211.60.1.el10_2, kernel on EL8 to 4.18.0-553.168.1.el8_10, kernel on EL9 to 5.14.0-687.52.1.el9_8, and kernel-rt on EL8 to 4.18.0-553.168.1.rt7.509.el8_10 (all via RHSA-2026:71329). If immediate patching is not possible, disable IPVS connection synchronization.

How to confirm the fix worked

Verify the installed kernel version matches or exceeds the listed fixed releases; confirm the patch by inspecting the ip_vs_bind_dest() function for the one-packet flag clearing logic on synced connections.

Typical attack path

  1. Configure IPVS with connection synchronization enabled
  2. Trigger creation of synced connections prior to destination registration
  3. Add the destination to invoke ip_vs_bind_dest() on the hashed connection
  4. Force connection expiry to skip unlinking due to the inherited flag
  5. Trigger use of the stale hash node pointing to freed memory

How to detect it

Inspect kernel logs and dmesg for oops, warnings, or panics referencing ip_vs_conn, ip_vs_bind_dest, or conn_tab; correlate with IPVS sync traffic patterns or connection table anomalies on affected kernels.

What your security team should do

  • Apply the Red Hat kernel updates within the next maintenance window given the critical CVSS and public disclosure
  • Temporarily disable connection synchronization in IPVS configurations where feasible
  • Review systems for IPVS usage and prioritize those with sync enabled
  • Monitor kernel logs for ip_vs_conn related oops or warnings post-update

The record

In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connection flags from the destination into cp->flags. IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed, expiry can treat it as a one-packet connection and skip unlinking the existing conn_tab node, leaving stale hash nodes pointing at a freed struct ip_vs_conn. Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced connections.

Affected packages

Ecosystem Package Introduced Fixed