CVE-2026-98857: ipvs: bound LBLCR and LBLC cache growth
In the Linux kernel, the following vulnerability has been resolved:
ipvs: bound LBLCR and LBLC cache growth
ipvslblcrnew() and ipvslblcnew() create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has already exceeded the limit. It does not reclaim entries that the attacker continues to use.
Reject new cache entries once either table reaches maxsize 3 / 2. The extra headroom lets the periodic collector catch up while the existing scheduler fallback continues to use the selected destination when cache creation fails. New traffic therefore stays serviceable without growing the tables further.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
For IPVS LBLCR and LBLC caches, reject new cache entries once either table reaches max_size * 3 / 2, and have the periodic collector reclaim entries when the cache has exceeded its max_size limit.
Event History
Frequently Asked Questions
Which systems are exposed to unbounded cache growth?
Systems using Linux IPVS with the LBLCR or LBLC scheduler are exposed. The issue occurs when those schedulers receive traffic for previously unseen destination addresses, causing new cache entries to be created.
What does an attacker need to do to trigger the issue?
An attacker needs to send traffic that causes the LBLCR or LBLC scheduler to encounter continually new destination addresses while continuing to use entries already created. The periodic collector can reclaim entries only after the configured table limit has been exceeded, and it does not remove entries that remain in use.
What happens if cache creation is rejected after the limit is reached?
The scheduler falls back to the selected destination, so new traffic remains serviceable. The fix rejects new cache entries once a table reaches max_size multiplied by 3/2, preventing further table growth while allowing the periodic collector to catch up.