CVE-2026-98857
Received Received - Intake

IPVS Cache Growth Bypass in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every previously unseen destination address. The table max_size only tells the periodic collector to reclaim entries after the cache has already exceeded the limit. It does not reclaim entries that the attacker continues to use. Reject new cache entries once either table reaches max_size * 3 / 2. The extra headroom lets the periodic collector catch up while the existing scheduler fallback continues to use the selected destination when cache creation fails. New traffic therefore stays serviceable without growing the tables further.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98857
EUVD
EUVD-2026-103797

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
Linux Linux 2.6.12

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves unbounded growth of cache entries in the IPVS (IP Virtual Server) LBLCR and LBLC schedulers. When new destination addresses are encountered, cache entries are created without proper limits. The max_size setting only triggers cleanup after exceeding the limit, allowing attackers to keep adding entries by using new addresses. The fix rejects new entries once the cache reaches max_size * 3 / 2, giving the collector time to reclaim old entries while maintaining service for existing traffic.

Detection Guidance

This vulnerability involves unbounded cache growth in the Linux kernel's IPVS LBLCR and LBLC schedulers. Detection requires checking kernel logs for excessive cache entries or performance degradation in load balancing. Commands like 'dmesg | grep -i ipvs' or 'journalctl -k | grep -i ipvs' may reveal related errors. Monitor cache sizes with 'ipvsadm -L -n' and check system performance metrics for unusual spikes.

Impact Analysis

This vulnerability could lead to denial-of-service conditions by consuming excessive memory in the kernel due to uncontrolled cache growth. Systems using IPVS with LBLCR or LBLC schedulers may experience performance degradation or crashes if an attacker exploits this to fill the cache. It may also allow attackers to disrupt network traffic handling.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a kernel-level issue related to cache growth in IPVS, which could lead to resource exhaustion but does not involve data breaches or privacy violations.

Mitigation Strategies

Apply the latest Linux kernel patches to address the unbounded cache growth issue. Update the kernel to a version containing the fix for CVE-2026-98857. If immediate patching is not possible, consider disabling the LBLCR and LBLC schedulers in IPVS or limiting their cache sizes via kernel parameters until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98857. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart