Answer in brief
CVE-2026-98857 records a Unknown severity vulnerability in ipvs: bound LBLCR and LBLC cache growth. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <31028d7b970962fbeda1e9131405c76551094300 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6316d17324bd4ca400c26adb7b656c6e3447c209 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <16c83c047ecfaf226ad81d45d77fa11a3184d0e4 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2a3c3de660f96865f303fd25f1285f2ffbfd521d | 31028d7b970962fbeda1e9131405c76551094300, 6316d17324bd4ca400c26adb7b656c6e3447c209, 16c83c047ecfaf226ad81d45d77fa11a3184d0e4, 2a3c3de660f96865f303fd25f1285f2ffbfd521d |
| Linux/Linuxgeneric | 2.6.12 | Not reported |
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <bc9ff8e64771cc32a216953fe615386f46ac1eaa || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <31028d7b970962fbeda1e9131405c76551094300 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <6316d17324bd4ca400c26adb7b656c6e3447c209 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <16c83c047ecfaf226ad81d45d77fa11a3184d0e4 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2a3c3de660f96865f303fd25f1285f2ffbfd521d | bc9ff8e64771cc32a216953fe615386f46ac1eaa, 31028d7b970962fbeda1e9131405c76551094300, 6316d17324bd4ca400c26adb7b656c6e3447c209, 16c83c047ecfaf226ad81d45d77fa11a3184d0e4, 2a3c3de660f96865f303fd25f1285f2ffbfd521d |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every previously unseen destination address. The table max_size only tells the periodic collector to reclaim entries after the cache has already exceeded the limit. It does not reclaim entries that the attacker continues to use. Reject new cache entries once either table reaches max_size * 3 / 2. The extra headroom lets the periodic collector catch up while the existing scheduler fallback continues to use the selected destination when cache creation fails. New traffic therefore stays serviceable without growing the tables further.
Quoted source text, attributed separately from HOL analysis.