Detections
Analytics
CVE-2026-98857
medium
Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every previously unseen destination address. The table max_size only tells the periodic collector to reclaim entries after the cache has already exceeded the limit. It does not reclaim entries that the attacker continues to use. Reject new cache entries once either table reaches max_size * 3 / 2. The extra headroom lets the periodic collector catch up while the existing scheduler fallback continues to use the selected destination when cache creation fails. New traffic therefore stays serviceable without growing the tables further.
References
https://git.kernel.org/stable/c/f6e9446bfb79907d3092fc45a0054b0c3b329bfe
https://git.kernel.org/stable/c/bc9ff8e64771cc32a216953fe615386f46ac1eaa
https://git.kernel.org/stable/c/8b93288b4543ad5139a25a5b211a07bf755652dd
https://git.kernel.org/stable/c/6316d17324bd4ca400c26adb7b656c6e3447c209
https://git.kernel.org/stable/c/488eaba207dd2e4c5afc65e18dc237d70f01d283
https://git.kernel.org/stable/c/31028d7b970962fbeda1e9131405c76551094300
https://git.kernel.org/stable/c/2a3c3de660f96865f303fd25f1285f2ffbfd521d
https://git.kernel.org/stable/c/16c83c047ecfaf226ad81d45d77fa11a3184d0e4