CVE-2026-98857

A flaw was found in the Linux kernel's IP Virtual Server (IPVS) module. The load-balancing cache fails to enforce strict bounds on table growth when entries remain continuously active. A remote attacker can exploit this vulnerability by transmitting network traffic to unique destination addresses, leading to excessive kernel memory consumption and a Denial of Service (DoS).

This vulnerability is rated as having Important impact because an unauthenticated remote attacker can exhaust system memory resources over the network, leading to a kernel denial of service on affected hosts. However, exploitation requires the system to be actively deployed as an IP Virtual Server (IPVS) load balancer configured with the locality-based least-connection (LBLC or LBLCR) scheduling algorithms. These scheduling modules are not loaded or active by default on standard Red Hat Enterprise Linux deployments, limiting exposure to environments explicitly utilizing these load-balancing policies.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.