From 5d8c21a5caed0cf88aa36fb02574e216af48c3cd Mon Sep 17 00:00:00 2001
From: Carter Li <zhangsongcui@live.cn>
Date: Thu, 2 Oct 2025 07:39:05 +0800
Subject: [PATCH] Memory (Linux): fallbacks to calcuate ourselves when
 `MemAvailable` seems unreasonable

Fixes #1988
---
 src/detection/memory/memory_linux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/detection/memory/memory_linux.c b/src/detection/memory/memory_linux.c
index 14c86bf93..42051279a 100644
--- a/src/detection/memory/memory_linux.c
+++ b/src/detection/memory/memory_linux.c
@@ -28,7 +28,7 @@ const char* ffDetectMemory(FFMemoryResult* ram)
 
     if((token = strstr(buf, "MemAvailable:")) != NULL)
         memAvailable = strtoul(token + strlen("MemAvailable:"), NULL, 10);
-    else
+    if (memAvailable == 0 || memAvailable >= memTotal) // MemAvailable can be unreasonable. #1988
     {
         if((token = strstr(buf, "MemFree:")) != NULL)
             memFree = strtoul(token + strlen("MemFree:"), NULL, 10);