CVE-2026-98857

ipvs: bound LBLCR and LBLC cache growth

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipvs: bound LBLCR and LBLC cache growth

ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every previously unseen destination address. The table max_size only tells the periodic collector to reclaim entries after the cache has already exceeded the limit. It does not reclaim entries that the attacker continues to use.

Reject new cache entries once either table reaches max_size * 3 / 2. The extra headroom lets the periodic collector catch up while the existing scheduler fallback continues to use the selected destination when cache creation fails. New traffic therefore stays serviceable without growing the tables further.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8b93288b4543ad5139a25a5b211a07bf755652ddAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f6e9446bfb79907d3092fc45a0054b0c3b329bfeAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 488eaba207dd2e4c5afc65e18dc237d70f01d283Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before bc9ff8e64771cc32a216953fe615386f46ac1eaaAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 31028d7b970962fbeda1e9131405c76551094300Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6316d17324bd4ca400c26adb7b656c6e3447c209Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 16c83c047ecfaf226ad81d45d77fa11a3184d0e4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2a3c3de660f96865f303fd25f1285f2ffbfd521dAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.56 through 6.18.Not affected 7.2.10 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8b93288b4543ad5139a25a5b211a07bf755652ddAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f6e9446bfb79907d3092fc45a0054b0c3b329bfeAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 488eaba207dd2e4c5afc65e18dc237d70f01d283Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before bc9ff8e64771cc32a216953fe615386f46ac1eaaAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 31028d7b970962fbeda1e9131405c76551094300Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6316d17324bd4ca400c26adb7b656c6e3447c209Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 16c83c047ecfaf226ad81d45d77fa11a3184d0e4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2a3c3de660f96865f303fd25f1285f2ffbfd521dAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.56 through 6.18.*Not affected
7.2.10 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.