CVE-2026-80714

The Linux kernel's IPVS (IP Virtual Server) load balancer mishandles the one-packet scheduling flag (IP_VS_CONN_F_ONE_PACKET) on connections received via state synchronization. A synced connection can be created before its destination exists; when that destination is later added, ip_vs_bind_dest() copies the destination's flags onto the connection, and if the already-hashed connection inherits the one-packet flag, expiration treats it as single-use and skips unlinking its connection-table node. This leaves stale hash-table entries pointing at a freed connection structure, producing a use-after-free that can crash the kernel (denial of service) or potentially allow exploitable memory corruption. Only Linux systems acting as IPVS load balancers with connection syncing enabled are affected, and the flaw is triggered by the combination of synced connections and destinations configured for one-packet scheduling (e.g., UDP services using --ops in ipvsadm). No public proof-of-concept, in-the-wild exploitation, or KEV listing is known; EPSS currently estimates a 0.4% probability of exploitation within 30 days.

What to do: Install a kernel update that includes the IPVS fix for CVE-2026-80714 once your distribution publishes one, since no fixed version numbers are provided in the source data. As an interim mitigation, avoid combining IPVS connection sync with one-packet-scheduled destinations (ipvsadm --ops, commonly used for UDP services) or disable the sync daemon until patched. Check exposure by confirming whether IPVS is active (ipvsadm -Ln), whether a sync daemon is running, and whether any destinations use one-packet scheduling.