CVE-2026-80714: Linux Kernel IPVS Privilege Escalation

CVE-2026-80714 Overview

CVE-2026-80714 is a Linux kernel vulnerability in the IP Virtual Server (IPVS) subsystem. The flaw allows stale hash table nodes to reference freed struct ip_vs_conn memory, resulting in a use-after-free condition. The issue occurs when synced connections inherit the IP_VS_CONN_F_ONE_PACKET flag from their destination after being hashed, causing connection expiry to skip proper unlinking from conn_tab.

Critical Impact
An attacker with network access to an IPVS-based load balancer can trigger memory corruption in the kernel. Successful exploitation may result in denial of service, information disclosure, or arbitrary code execution in kernel context.

Affected Products

Linux Kernel (IPVS subsystem — net/netfilter/ipvs/ip_vs_conn.c)
Systems running IPVS in synchronization mode (backup nodes receiving synced connections)
Load balancers and clusters using IPVS connection sync

Discovery Timeline

2026-08-28 - CVE-2026-80714 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80714

Vulnerability Analysis

The vulnerability resides in IPVS connection synchronization logic. Synced connections can be created on backup nodes before their destination service entries exist. When a destination is later added, ip_vs_bind_dest() copies flags from the destination into the connection's cp->flags field. This copy operation does not filter the IP_VS_CONN_F_ONE_PACKET flag.

One-packet connections are transient by design. They are not synced between IPVS peers and expire immediately after handling a single packet. Standard connections, in contrast, are inserted into the conn_tab hash table for the duration of their lifetime.

When an already-hashed synced connection inherits the one-packet flag through ip_vs_bind_dest(), subsequent expiry logic treats it as a one-packet connection. Expiry then skips the unlink step that would normally remove the entry from conn_tab. The connection structure is freed while its hash node remains linked, producing a dangling pointer usable by later lookups.

Root Cause

The root cause is unsafe flag propagation in ip_vs_bind_dest(). The function copies destination flags without masking flags that are incompatible with the hashed state of a synced connection. This creates an inconsistency between the connection's state (hashed) and its behavior (treated as one-packet at expiry).

Attack Vector

An attacker sends network traffic to a backup IPVS node that has received synced connection state but not yet resolved the destination. When the destination is added and inherits the one-packet flag, expiry frees the connection while leaving stale entries in conn_tab. Subsequent packet lookups dereference freed memory, enabling use-after-free exploitation without authentication or user interaction. See the upstream patch commit for the code-level fix.

// Vulnerability mechanism (prose description):
// 1. Synced conn created and inserted into conn_tab (hashed state).
// 2. Destination added later; ip_vs_bind_dest() copies dest->flags to cp->flags.
// 3. IP_VS_CONN_F_ONE_PACKET flag now set on already-hashed conn.
// 4. On expiry, code path skips conn_tab unlink for one-packet conns.
// 5. Result: freed ip_vs_conn with live hash node → use-after-free.

Detection Methods for CVE-2026-80714

Indicators of Compromise

Kernel oops or panic messages referencing ip_vs_conn_hash, ip_vs_conn_expire, or conn_tab after IPVS sync traffic
KASAN reports flagging use-after-free in net/netfilter/ipvs/ip_vs_conn.c
Unexpected crashes on IPVS backup nodes following destination reconfiguration

Detection Strategies

Enable CONFIG_KASAN on non-production IPVS nodes to surface use-after-free access at runtime
Audit kernel versions across load balancer fleets and compare against the fixed stable branches listed in the kernel.org commits
Monitor dmesg and syslog for slab corruption warnings and general protection faults in IPVS code paths

Monitoring Recommendations

Forward kernel logs from IPVS director and backup nodes to a centralized log platform for correlation
Alert on repeated IPVS connection sync errors or unusual restart patterns on cluster members
Track IPVS destination add/remove events alongside sync daemon activity to identify anomalous sequences

How to Mitigate CVE-2026-80714

Immediate Actions Required

Apply vendor-supplied kernel updates that include the fix from the referenced stable commits
Prioritize patching IPVS backup nodes and any host receiving connection sync traffic
Restrict access to IPVS sync multicast groups to trusted management networks only

Patch Information

The fix drops IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced connections in ip_vs_bind_dest(). Patched commits are available across multiple stable branches, including 06d1d9b, 300348e, 44af98c, 4649e6f, a63d2db, acbdc27, b5ee5b2, and e7acfc9. Consult your Linux distribution's security advisories for backported packages.

Workarounds

Disable IPVS connection synchronization (ipvsadm --stop-daemon) where high availability is not required
Isolate IPVS sync traffic on a dedicated management VLAN to prevent unauthorized peers from injecting synced state
Avoid dynamic destination additions on running IPVS backup nodes until patches are deployed

bash

# Stop IPVS sync daemons on affected nodes
ipvsadm --stop-daemon master
ipvsadm --stop-daemon backup

# Verify installed kernel version against distribution advisories
uname -r