---
title: "CVE-2026-80714 — A late IPVS binding could leave a freed connection in the table"
description: "CVE-2026-80714: An IPVS connection received through synchronization could be added to the lookup table before it had a destination. If a destination was attached later and marked the connection as “one packet,” expiry freed the object without first removing its existing table entries. Fixed upstream in July 2026."
url: https://nebusec.ai/buglist/CVE-2026-80714/
published: 2026-08-30T00:00:00.000Z
---

CVE-2026-80714 · High

# A late IPVS binding could leave a freed connection in the table

Linux kernel · IPVS · Published Aug 30, 2026

ip_vs_try_bind_dest

* Fixed
* Memory-corruption
* Namespace required

Affects · Linux v2.6.36 until the fix · Debian 13 · Linux 6.12.101 demo target

[View exploit→](#exploit)

Artifacts · [exploit.md](#exploit) · [patch.diff](#patch)

## Summary

An IPVS connection received through synchronization could be added to the lookup table before it had a destination. If a destination was attached later and marked the connection as “one packet,” expiry freed the object without first removing its existing table entries.

The vulnerable behavior dated to July 2010 and was fixed upstream in July 2026. The public exploit was validated on Debian 13 with Linux 6.12.101.

## Why it mattered

A local attacker able to configure IPVS in a network namespace could drive the late-binding path. Once the connection expired, later lookup or cleanup followed a table entry into freed memory, allowing kernel memory corruption and local privilege escalation.

The affected code has been fixed. The risk described here applies to unpatched kernels in the affected line, not automatically to every system using the named distribution today.

## What went wrong

`ip_vs_bind_dest()` copied the destination flags into a connection that was already hashed. The expiry path assumes one-packet connections were never synchronized or inserted in that form, so it skipped the unlink step required by this exceptional sequence.

## Exploit

Because the issue and its fixes are public, NebuSec’s validation code is included here for reproducibility. The preview starts at the program entry point and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; build files, headers, helpers, and any additional sources remain in the linked CyberMeowfia directory.

Public exploit · patched target

CyberMeowfia snapshot4c1f0aa

[Browse all files](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-80714-Debian-6.12.101)

Exploit entry point · 606 lines · [Open at main() ↗](https://github.com/NebuSec/CyberMeowfia/blob/4c1f0aaaf1b981e74c47f24d88ebdf6ad51c9586/security-research/Linux-CVE-2026-80714-Debian-6.12.101/exploit.c#L528)

```c
int main(int argc, char **argv)
{
  unsigned count = argc > 1 ? (unsigned)strtoul(argv[1], NULL, 0) : 4096;
  size_t pages = argc > 2 ? strtoul(argv[2], NULL, 0) : 98304;
  int anchor_fd, sender, ctl;
  uint64_t physmap, slide;
  void *anchor;
  int spray_fds[2];
  void *spray_maps[2];

  enter_namespaces();
  autoload_ipvs();
  ctl = ipvs_sock();
  prepare_root_helper();
  slide = leak_image_slide(22);
```

The selected file is the execution entry point. Build files, headers, leak helpers, and supporting sources remain in the linked CyberMeowfia directory.

## Patch

**Fixed upstream in July 2026.** The fix keeps synchronized connection state and hash-table cleanup consistent when a destination is bound late. Use a Debian kernel containing the July 2026 correction; the 6.12.101 build is the historical exploit target.

The safest check is the distribution’s own kernel changelog for `CVE-2026-80714`; version numbers alone can be misleading because vendors routinely backport security fixes without changing to the newest upstream kernel.

Find bugs in your code.

Before anyone else does.

[Book a demo](https://nebusec.ai/book-a-demo/)