9.8

CVE-2026-80714: linux

CVSS: 9.8v3.1CriticalReceived
AliasesUBUNTU-CVE-2026-80714DEBIAN-CVE-2026-80714
Published 28-08-2026Last modified 16-10-2026
Open JSON

Vulnerability summary

CVE-2026-80714 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.48%
0%100%
Low · +0.07 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 22 · Related 18
OPENSUSE-SU-2026:21910-1RHSA-2026:71329RHSA-2026:71330RHSA-2026:71602RHSA-2026:71700SUSE-SU-2026:23881-1

Timeline

  1. 28-08-2026
    PublishedVulnerability first disclosed.
  2. 16-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: ipvs: do not propagate one-packet flag to synced conns Synced connections can be created before their destination exists. When the destination is later added, ip_vs_bind_dest() copies connection flags from the destination into cp->flags. IP_VS_CONN_F_ONE_PACKET connections are not synced. If a synced connection inherits IP_VS_CONN_F_ONE_PACKET while it is already hashed, expiry can treat it as a one-packet connection and skip unlinking the existing conn_tab node, leaving stale hash nodes pointing at a freed struct ip_vs_conn. Drop IP_VS_CONN_F_ONE_PACKET from destination flags when binding synced connections.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.48%

Chance of exploitation in the next 30 days

Percentile

40%

Versus all other CVEs

30-day change

+0.07 pp

From 0.40% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.48%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu169 products
  • linuxAll versions (No fix recorded) | < 5.15.0-198.208
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.8-1
  • linux-6.12< 6.12.107-1~deb12u1
Linux1 product
  • linux≥ 26ec037f9841e49cc5c615deb8e1e73e5beab2ca, < 06d1d9b56ef8132fbf85006885eb43d9510b8b02 | ≥ 26ec037f9841e49cc5c615deb8e1e73e5beab2ca, < acbdc276091b308ca7794acb86e761f8203e2f59 | ≥ 26ec037f9841e49cc5c615deb8e1e73e5beab2ca, < 300348e3ba1521b003d59825f97e24f9a6859688 | ≥ 26ec037f9841e49cc5c615deb8e1e73e5beab2ca, < 44af98cc7d5ef8e730488d5df1eecd5deeaa5947 | ≥ 26ec037f9841e49cc5c615deb8e1e73e5beab2ca, < 4649e6faeecdc2d44bfa6ccbe405eef27e55d816 | ≥ 26ec037f9841e49cc5c615deb8e1e73e5beab2ca, < b5ee5b266f833601ac4817f6df0bc496fc376a28 | ≥ 26ec037f9841e49cc5c615deb8e1e73e5beab2ca, < e7acfc990c29890c883d0d0ce3f737d003a43b44 | ≥ 26ec037f9841e49cc5c615deb8e1e73e5beab2ca, < a63d2dbaeb50a85d4c976b15a36e6b0c7113db5b | 2.6.36

3 vendors · 172 products

References

18 links
Show all 18 references