HIGH Introduced in 2.6.12
ipvs SchedulerCache Exhaustion
CVE-2026-98857
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for every previously unseen destination address. The table max_size only tells the periodic collector to reclaim entries after the cache has already exceeded the limit. It does not reclaim entries that the attacker continues to use. Reject new cache entries once either table reaches max_size * 3 / 2. The extra headroom lets the periodic collector catch up while the existing scheduler fallback continues to use the selected destination when cache creation fails. New traffic therefore stays serviceable without growing the tables further.
02KernelScan AI Analysis
Risk summary
An unauthenticated network attacker can exhaust kernel memory by sending traffic to many distinct destination addresses through an IPVS load balancer using the LBLC or LBLCR schedulers. The cache grows without bound because the configured max_size is only enforced by a periodic garbage collector, not at allocation time. This leads to system-wide out-of-memory conditions, freezing or crashing the host.
Vulnerability analysis
The IPVS LBLC and LBLCR schedulers create a cache entry for every new destination address they see. The configured size limit was only enforced by a background cleanup task, so an attacker sending packets to many different destination IPs could force the cache to grow without bound, eventually exhausting kernel memory. The fix adds a hard limit: once the cache reaches 1.5 times its configured size, new entries are refused and the scheduler falls back to its default behavior, keeping the service working while the cleanup catches up. Any network sender that can reach the IPVS load balancer can trigger this — no authentication or local access needed.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 2.6.12 | 6.12.113 | 31028d7b9709 |
| 6.18 | 2.6.12 | 6.18.56 | 6316d17324bd |
| 6.6 | 2.6.12 | 6.6.160 | bc9ff8e64771 |
| 7.2 | 2.6.12 | 7.2.10 | 16c83c047ecf |
| mainline | 2.6.12 | 7.3 | 2a3c3de660f9 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Affected — no CIP fix yet (latest 6.12.112-cip33) |
| cip/6.1 | Affected — no CIP fix yet (latest 6.1.189-cip61) |
| cip/6.1-rt | Affected — no CIP fix yet (latest 6.1.189-cip61-rt32) |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |
| cip/4.4 | Affected — no CIP fix yet (latest 4.4.302-cip115) |
| cip/4.4-rt | Affected — no CIP fix yet (latest 4.4.302-cip115-rt63) |