SB20261022478 - Allocation of Resources Without Limits or Throttling in Linux kernel netfilter ipvs

Description

This security bulletin contains information about 1 vulnerability.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-98857)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to exhaust kernel memory and potentially cause a denial of service.

The vulnerability exists due to unrestricted cache entry allocation in the Linux kernel IPVS LBLC and LBLCR schedulers when handling traffic to previously unseen destination addresses. A remote attacker can generate traffic to many distinct destination addresses and continue using the resulting cache entries to prevent their reclamation, allowing cache growth to exhaust kernel memory and potentially cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/16c83c047ecfaf226ad81d45d77fa11a3184d0e4
• https://git.kernel.org/stable/c/2a3c3de660f96865f303fd25f1285f2ffbfd521d
• https://git.kernel.org/stable/c/31028d7b970962fbeda1e9131405c76551094300
• https://git.kernel.org/stable/c/6316d17324bd4ca400c26adb7b656c6e3447c209
• https://git.kernel.org/stable/c/bc9ff8e64771cc32a216953fe615386f46ac1eaa