Linux Kernel ip_vs LBLCR/LBLC Cache Growth DoS Vulnerability
CVE-2026-98857 Published on October 18, 2026
ipvs: bound LBLCR and LBLC cache growth
In the Linux kernel, the following vulnerability has been resolved:
ipvs: bound LBLCR and LBLC cache growth
ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for
every previously unseen destination address. The table max_size only
tells the periodic collector to reclaim entries after the cache has
already exceeded the limit. It does not reclaim entries that the
attacker continues to use.
Reject new cache entries once either table reaches max_size * 3 / 2.
The extra headroom lets the periodic collector catch up while the
existing scheduler fallback continues to use the selected destination
when cache creation fails. New traffic therefore stays serviceable
without growing the tables further.
Products Associated with CVE-2026-98857
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 31028d7b970962fbeda1e9131405c76551094300 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 6316d17324bd4ca400c26adb7b656c6e3447c209 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 16c83c047ecfaf226ad81d45d77fa11a3184d0e4 is affected.
- Version 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 and below 2a3c3de660f96865f303fd25f1285f2ffbfd521d is affected.
- Version 2.6.12 is affected.
- Before 2.6.12 is unaffected.
- Version 6.12.113, <= 6.12.* is unaffected.
- Version 6.18.56, <= 6.18.* is unaffected.
- Version 7.2.10, <= 7.2.* is unaffected.
- Version 7.3-rc6, <= * is unaffected.