CVE-2026-98857: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98857 is a denial-of-service vulnerability in the Linux kernel's IPVS (IP Virtual Server) subsystem affecting the LBLCR (Locality-Based Least-Connection with Replication) and LBLC (Locality-Based Least-Connection) load balancing schedulers. The functions ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every previously unseen destination address without enforcing an effective upper bound, allowing unbounded cache growth. The vulnerability affects the Linux kernel from version 2.6.12 onward, with fixes available in versions 6.12.113, 6.18.56, 7.2.10, and 7.3-rc6. It was published on October 18, 2026, and carries an estimated CVSS severity of Medium (GitHub Advisory, Feedly).

The root cause is an improper resource control flaw (related to CWE-400: Uncontrolled Resource Consumption) in the IPVS LBLCR and LBLC scheduler cache management. The max_size parameter only triggers periodic garbage collection after the cache has already exceeded its limit, and the collector does not evict entries that are actively being referenced by an attacker. An unauthenticated network attacker can exploit this by sending traffic with a continuous stream of varying destination addresses, causing the kernel to allocate new cache entries indefinitely. The fix rejects new cache entries once either table reaches max_size * 3 / 2, providing headroom for the periodic collector to reclaim entries while the scheduler fallback continues to serve existing traffic (GitHub Advisory, Kernel Patch).

Successful exploitation causes unbounded kernel memory exhaustion on systems running IPVS with LBLCR or LBLC schedulers, ultimately leading to denial of service of the load balancer. An unauthenticated remote attacker can trigger this condition without any special privileges by simply sending traffic with varying destination addresses. There is no evidence of confidentiality or integrity impact; the primary consequence is availability loss affecting the load-balanced services (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, reflecting a very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires only network access to the IPVS load balancer and no authentication, but the attack is limited to denial of service (GitHub Advisory, Feedly).

1. Reconnaissance: Identify target systems running Linux with IPVS enabled and using the LBLCR or LBLC scheduling algorithm (e.g., via network scanning or service enumeration of load balancer endpoints).
2. Craft high-volume traffic: Generate a large volume of network packets directed at the IPVS load balancer, each using a distinct, previously unseen destination IP address to force new cache entry creation in ip_vs_lblcr_new() or ip_vs_lblc_new().
3. Sustain cache pressure: Continuously reference the created cache entries to prevent the periodic garbage collector from reclaiming them, keeping the cache above max_size and growing indefinitely.
4. Achieve denial of service: As kernel memory is exhausted by unbounded cache growth, the load balancer becomes unresponsive or crashes, denying service to legitimate users (GitHub Advisory, Feedly).

• Network: Unusually high volume of inbound traffic to the IPVS load balancer with a large number of distinct destination IP addresses; traffic patterns inconsistent with normal load balancing workloads.
• System: Rapid increase in kernel memory usage (/proc/meminfo showing declining MemFree/MemAvailable); OOM (Out-of-Memory) killer events in system logs related to kernel IPVS processes.
• Logs: Kernel log messages (dmesg) indicating memory allocation failures or OOM conditions; IPVS-related warnings about cache table size thresholds being exceeded.
• Process: Degraded or unresponsive load balancer behavior; increased latency or dropped connections on IPVS-managed virtual services.

Apply the available kernel patches that implement cache entry rejection once LBLCR or LBLC tables reach max_size * 3 / 2. Fixed versions are 6.12.113, 6.18.56, 7.2.10, and 7.3-rc6 (commit 7.3-rc6). The specific fix commits are 31028d7b, 6316d173, 16c83c04, and 2a3c3de6 on the stable kernel trees. As a workaround prior to patching, restrict network access to the IPVS load balancer to trusted sources only, or configure firewall/rate-limiting rules to limit the rate of traffic with varying destination addresses (GitHub Advisory, Kernel Patch).