Executive brief
The Linux kernel's IPVS (IP Virtual Server) load balancing subsystem contains a memory corruption vulnerability affecting synchronized cluster connections. Attackers on the network can trigger a use-after-free condition that crashes the kernel or enables privilege escalation, disrupting load-balanced services and potentially compromising the entire system.
Technical details
A use-after-free vulnerability exists in net/netfilter/ipvs/ip_vs_conn.c within the connection binding logic. When IPVS syncs connections across cluster nodes, synced connections can be created before their destination is added. Later, when ip_vs_bind_dest() binds the connection to its destination, it copies the IP_VS_CONN_F_ONE_PACKET flag from destination configuration into the already-hashed synced connection. One-packet connections are not meant to be synced; if a synced connection inherits this flag while already in the hash table, expiry logic skips proper unlinking, leaving stale pointers to freed memory. This is triggered via network traffic reaching IPVS-configured destinations and exploitable without authentication. Patch fixes this by clearing the IP_VS_CONN_F_ONE_PACKET flag when binding synced connections.
Affected products
- Linux Linux kernel all versions from 2.6.11 through 6.18+ (fixed by commit a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b)
Timeline
- 2026-08-28: disclosed
- 2026-08-19: patched