{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98857 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-98857 is a denial of service vulnerability in Linux, published on 18 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-98857 and fix it if it is affected.\n\nWhat it is: CVE-2026-98857 is a denial of service vulnerability in Linux, published on 18 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-98857 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98857/ (Markdown: https://insights.sbomify.com/CVE-2026-98857/index.md)","id":"CVE-2026-98857","markdown":"https://insights.sbomify.com/CVE-2026-98857/index.md","name":"CVE-2026-98857","record":{"aliases":["AZL-109176","BELL-CVE-2026-98857","DEBIAN-CVE-2026-98857","GHSA-3qgh-gjj6-qj8r","UBUNTU-CVE-2026-98857"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel IPVS","requires_auth":"none","summary":"An attacker can cause a denial of service in the Linux kernel IPVS module by exhausting memory through unbounded cache growth in LBLCR and LBLC schedulers.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nipvs: bound LBLCR and LBLC cache growth\n\nip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for\nevery previously unseen destination address. The table max_size only\ntells the periodic collector to reclaim entries after the cache has\nalready exceeded the limit. It does not reclaim entries that the\nattacker continues to use.\n\nReject new cache entries once either table reaches max_size * 3 / 2.\nThe extra headroom lets the periodic collector catch up while the\nexisting scheduler fallback continues to use the selected destination\nwhen cache creation fails. New traffic therefore stays serviceable\nwithout growing the tables further.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ipvs: bound LBLCR and LBLC cache growth","id":"CVE-2026-98857","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"io_uring: fix task_work add use-after-free with SQPOLL","id":"CVE-2026-98858"},"packages":[],"prev":{"headline":"kprobes: Skip disarmed probes when checking optkprobe overlap","id":"CVE-2026-98856"},"products":["Linux"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"An attacker can cause a denial of service in the Linux kernel IPVS module by exhausting memory through unbounded cache growth in LBLCR and LBLC schedulers.","url":"https://insights.sbomify.com/CVE-2026-98857/"}