ipvs SyncedConn UAF

Vulnerability analysis

When IPVS connection synchronization is active, a synced connection can be created before its destination exists. When that destination is later added with one-packet scheduling enabled, the binding process copies the one-packet flag into the already-hashed synced connection. On expiry, the one-packet flag causes the kernel to skip unlinking the connection from the global hash table, leaving stale hash nodes pointing at freed memory. The fix strips the one-packet flag from the destination flags before they are applied to a synced connection, so the expiry path always correctly unlinks the connection. This vulnerability is reachable from a local context requiring CAP_NET_ADMIN in the init namespace to configure IPVS with sync and one-packet scheduling, combined with network traffic flowing through the load balancer to create the synced connections.