Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connection flags from the destination into cp->flags. IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed, expiry can treat it as a one-packet connection and skip unlinking the existing conn_tab node, leaving stale hash nodes pointing at a freed struct ip_vs_conn. Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced connections.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026082809-CVE-2026-80714-799a@gregkh/T
Additional information: A public exploit for CVE-2026-80714 has been published by Nebula Security: https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-80714-Debian-6.12.101 The repository contains exploit code targeting the vulnerable IPVS code path. A demonstration video showing successful local privilege escalation (LPE) has also been published: https://x.com/cybermeowfia/status/2094317678731383185 According to the current Red Hat CVE data, RHEL 7, RHEL 8, RHEL 9, and RHEL 10 are affected. Possible mitigation: On systems where IPVS is not required and the ip_vs functionality is provided as a loadable kernel module, loading of the module can be disabled: echo 'install ip_vs /bin/false' > /etc/modprobe.d/disable-ip_vs.conf This mitigation should prevent access to the vulnerable IPVS code path when the module is not already loaded and IPVS functionality is not required. Considering that a working public exploit and an LPE demonstration are now available, could Red Hat please consider documenting this mitigation on the CVE page and take the exploit availability into account when evaluating remediation priority?