An unbounded cache growth flaw was found in the Linux kernel’s IPVS subsystem. The functions that build the LBLCR and LBLC routing tables allocate a new cache entry whenever an address that has not yet been seen appears. The upstream mechanism that cleans up expired entries only runs after the cache has already exceeded a pre‑configured maximum, so an attacker can continually introduce new destinations or repeatedly access existing ones to force the cache to grow without restriction. Because the IPVS load‑balancer runs in kernel space and the interface to add destinations is open to any traffic, the attacker can trigger this condition from the network without authentication. The result is kernel memory exhaustion that can bring the system to a halt, effectively denying all services that rely on the affected host.

The flaw affects all Linux kernel versions that ship with the IPVS load‑balancer module and implement the LBLCR and LBLC routing tables. No specific version numbers were provided in the advisory, so any kernel running the affected IPVS code is potentially vulnerable. The vendor list identifies Linux distributions only, suggesting the issue is cross‑distribution. Users should verify whether their kernel commit series includes the patch introduced by the four commit references listed.

The CVSS score is 7.5, indicating a high severity, and the EPSS score is < 1%. The flaw is not listed in the CISA KEV catalog, but its nature—kernel memory exhaustion triggered by simple traffic patterns—already indicates a high risk of denial of service. Because the IPVS interface is open to the network, an attacker can initiate the attack from the outside. The lack of authentication further simplifies the exploit. While the exact probability of exploitation is unknown, the mechanism is deterministic once the load‑balancer receives a high volume of traffic with many distinct destinations.