CVE-2026-80714

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) component. When a synced connection is established, it can incorrectly inherit a "one-packet" flag from its destination. This misconfiguration causes the connection's expiry process to mishandle its cleanup, leaving behind stale memory references. This issue could potentially be exploited by an attacker to cause a denial of service (DoS) or lead to system instability.

This vulnerability is rated as Important because an authenticated local user could exploit improper connection cleanup in the kernel to trigger memory corruption, potentially leading to a denial of service or local privilege escalation. On default Red Hat Enterprise Linux deployments, IP Virtual Server synchronization is not enabled unless the system is specifically configured as a load-balancing node or cluster proxy. Hosts that do not load the IPVS subsystem or participate in connection state replication are not exposed to this flaw during standard operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the ip_vs kernel module from loading. This can be achieved by creating a blacklist rule. Note that this may impact systems utilizing IPVS for load balancing.

1. Create a configuration file to blacklist the module: echo "blacklist ip_vs" > /etc/modprobe.d/disable-ip_vs.conf

2. Regenerate the initramfs to ensure the blacklist is applied at boot: dracut -f -v

3. Reboot the system for the changes to take effect: reboot

Alternatively, if the module is currently loaded, it can be unloaded (if no dependencies exist): rmmod ip_vs However, a system reboot is recommended to ensure the module is not loaded on subsequent boots.