In the Linux kernel, the following vulnerability has been resolved:

ipvs: do not propagate one-packet flag to synced conns

Synced connections can be created before their destination exists. When the destination is later added, ip vs bind dest() copies connection flags from the destination into cp->flags.

IP VS CONN F ONE PACKET connections are not synced. If a synced connection inherits IP VS CONN F ONE PACKET while it is already hashed, expiry can treat it as a one-packet connection and skip unlinking the existing conn tab node, leaving stale hash nodes pointing at a freed struct ip vs conn.

Drop IP VS CONN F ONE PACKET from destination flags when binding synced connections.