Description

In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connection flags from the destination into cp->flags. IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed, expiry can treat it as a one-packet connection and skip unlinking the existing conn_tab node, leaving stale hash nodes pointing at a freed struct ip_vs_conn. Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced connections.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:57.053Z",
  "pubdate": "2026-08-28T08:16:57.053Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel IPVS (IP Virtual Server) component due to improper flag propagation during connection synchronization.\nThe vulnerability occurs when a synced connection incorrectly inherits the IP_VS_CONN_F_ONE_PACKET flag from a destination, causing the kernel to skip necessary connection cleanup procedures.\nAn attacker can leverage this flaw to trigger stale hash entries that point to memory already released by the kernel, potentially leading to kernel panics, denial-of-service, or arbitrary code execution scenarios.\nThis vulnerability affects Linux kernel systems utilizing IPVS connection synchronization features. Successful exploitation requires an attacker to interact with the IPVS load balancing infrastructure, potentially allowing for memory corruption within the kernel space.\nThere are no specific authentication requirements for triggering the flaw if the attacker can reach the IPVS load balancer, though local privilege is often a prerequisite for manipulating network configurations.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic within ip_vs_bind_dest() during the binding of a destination to a synchronized connection. In IPVS, synced connections are often initialized before the corresponding destination object is available. When the destination is subsequently added, the kernel copies flags from the destination object directly into the connection's flags (cp->flags).\nThe IP_VS_CONN_F_ONE_PACKET flag is designed for connections that are effectively single-packet, where the connection state should not persist in the global connection hash table after transmission. However, synchronized connections are persistent by design and should never possess this flag. When a synchronized connection incorrectly inherits the IP_VS_CONN_F_ONE_PACKET flag via destination binding while already inserted into the hash table (conn_tab), the kernel's expiry mechanism is compromised.\nDuring the expiry process, the kernel checks for the presence of the IP_VS_CONN_F_ONE_PACKET flag. If detected, the expiry logic assumes the connection does not need to be unlinked from the global connection hash table (conn_tab) because it perceives the connection as transient. Since the connection was already hashed, failing to unlink it results in a 'stale' hash node. This stale node continues to point to the struct ip_vs_conn object even after that memory has been freed and potentially reallocated.\nExploitation occurs when a subsequent kernel operation traverses the connection hash table and accesses the dangling pointer. Because the pointer references freed memory, any attempt to read or modify the contents of the stale ip_vs_conn structure results in a use-after-free condition. This can lead to kernel memory corruption, data leaks, or system instability/crashes.\nThis issue represents a flaw in the state management of the IPVS connection tracking system. By manipulating destination properties or inducing state synchronization, an attacker can coerce the kernel into an inconsistent state where the hash table entries and the actual connection life-cycle management are desynchronized."
}