{"cve":"CVE-2026-80714","nvd":{"published":"2026-08-28T08:16:57.053","modified":"2026-10-16T20:18:08.073","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: do not propagate one-packet flag to synced conns\n\nSynced connections can be created before their destination exists. When\nthe destination is later added, ip_vs_bind_dest() copies connection flags\nfrom the destination into cp->flags.\n\nIP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced\nconnection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed,\nexpiry can treat it as a one-packet connection and skip unlinking the\nexisting conn_tab node, leaving stale hash nodes pointing at a freed\nstruct ip_vs_conn.\n\nDrop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced\nconnections.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":[],"references":["https://git.kernel.org/stable/c/06d1d9b56ef8132fbf85006885eb43d9510b8b02","https://git.kernel.org/stable/c/300348e3ba1521b003d59825f97e24f9a6859688","https://git.kernel.org/stable/c/44af98cc7d5ef8e730488d5df1eecd5deeaa5947","https://git.kernel.org/stable/c/4649e6faeecdc2d44bfa6ccbe405eef27e55d816","https://git.kernel.org/stable/c/a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:50:50.842544443+00:00"},"epss":{"cve":"CVE-2026-80714","score":0.00479,"percentile":0.41053,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}