In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip_vs_lblcr_new() and ip_vs_lblc_new()… (CVE-2026-98857)

The Linux kernel IPVS component had a vulnerability where the LBLCR and LBLC caches could grow without effective bounds because the max_size parameter only triggered periodic reclamation after the cache exceeded the limit, but did not prevent attackers from continuously adding new entries. This could lead to resource exhaustion. The patch bounds cache growth by rejecting new entries once the cache size reaches max_size * 3 / 2, allowing the periodic collector to reclaim entries and the scheduler fallback to continue serving traffic without further cache growth.

The vulnerability could allow an attacker to cause unbounded growth of IPVS cache tables, potentially leading to resource exhaustion and degraded service availability. However, the fix ensures that new cache entries are rejected beyond a threshold, maintaining serviceability and preventing further cache growth.

A fix has been implemented in the Linux kernel to bound the growth of the LBLCR and LBLC caches by rejecting new entries once the cache size reaches 1.5 times the configured max_size. Users should apply the official Linux kernel update that includes this patch to remediate the vulnerability. No additional mitigation steps are indicated.