Bug 2525436 (CVE-2026-80714)

Summary:	CVE-2026-80714 kernel: ipvs: do not propagate one-packet flag to synced conns
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, akito5623, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers, yozone
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. When a synced connection is established, it can incorrectly inherit a "one-packet" flag from its destination. This misconfiguration causes the connection's expiry process to mishandle its cleanup, leaving behind stale memory references. This issue could potentially be exploited by an attacker to cause a denial of service (DoS) or lead to system instability.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-28 07:44:53 UTC

In the Linux kernel, the following vulnerability has been resolved:

ipvs: do not propagate one-packet flag to synced conns

Synced connections can be created before their destination exists. When
the destination is later added, ip_vs_bind_dest() copies connection flags
from the destination into cp->flags.

IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced
connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,
expiry can treat it as a one-packet connection and skip unlinking the
existing conn_tab node, leaving stale hash nodes pointing at a freed
struct ip_vs_conn.

Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced
connections.

Comment 1 gkamathe 2026-09-01 09:41:24 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026082809-CVE-2026-80714-799a@gregkh/T

Comment 5 Akiyoshi Kurita 2026-09-04 01:42:39 UTC

Additional information:

A public exploit for CVE-2026-80714 has been published by Nebula Security:

https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-80714-Debian-6.12.101

The repository contains exploit code targeting the vulnerable IPVS code path.

A demonstration video showing successful local privilege escalation (LPE) has also been published:

https://x.com/cybermeowfia/status/2094317678731383185

According to the current Red Hat CVE data, RHEL 7, RHEL 8, RHEL 9, and RHEL 10 are affected.

Possible mitigation:

On systems where IPVS is not required and the ip_vs functionality is provided as a loadable kernel module, loading of the module can be disabled:

echo 'install ip_vs /bin/false' > /etc/modprobe.d/disable-ip_vs.conf

This mitigation should prevent access to the vulnerable IPVS code path when the module is not already loaded and IPVS functionality is not required.

Considering that a working public exploit and an LPE demonstration are now available, could Red Hat please consider documenting this mitigation on the CVE page and take the exploit availability into account when evaluating remediation priority?