CVE-2026-98569

Received Received - Intake

Linux Kernel GRE Tunnel Metadata Mode Bypass

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ip_gre: Reject enabling collect metadata through changelink ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a non-metadata device can therefore replace the metadata receive entry for another device of the same type in the same netns. Deleting either device then clears the shared entry, breaking metadata receive lookup for the surviving device. If parameter validation fails after collect_md is set, deleting the modified device can also clear an entry it never owned. Reject enabling metadata mode in both changelink callbacks before any encapsulation or tunnel parameters are modified. Allow requests that repeat the metadata attribute on an existing metadata device.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98569

EUVD

EUVD-2026-103614

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	2e15ea390e6f4466655066d97e22ec66870a042c
Linux	Linux	2e15ea390e6f4466655066d97e22ec66870a042c
Linux	Linux	2e15ea390e6f4466655066d97e22ec66870a042c
Linux	Linux	2e15ea390e6f4466655066d97e22ec66870a042c
Linux	Linux	2e15ea390e6f4466655066d97e22ec66870a042c
Linux	Linux	2e15ea390e6f4466655066d97e22ec66870a042c
Linux	Linux	2e15ea390e6f4466655066d97e22ec66870a042c
Linux	Linux	2e15ea390e6f4466655066d97e22ec66870a042c
Linux	Linux	4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the GRE (Generic Routing Encapsulation) tunnel implementation. It allows an attacker to replace the metadata receive entry for another device in the same network namespace by enabling collect metadata mode on an existing GRE, GRETAP, or ERSPAN device through changelink. This can break metadata receive lookup for the surviving device when either device is deleted.

Detection Guidance

This vulnerability affects the Linux kernel's GRE, GRETAP, or ERSPAN tunnel devices when collect metadata mode is enabled improperly. To detect it, check for active GRE tunnels with metadata mode enabled using commands like 'ip -d link show' or 'ip tunnel show'. Look for devices with 'collect_md' or similar metadata flags. If metadata mode is enabled on an existing device without proper validation, it may indicate exploitation.

Impact Analysis

If exploited, this vulnerability could disrupt network traffic handling for GRE tunnels, leading to potential denial of service or misrouting of packets. Systems relying on GRE tunnels for network connectivity or encapsulation may experience instability or loss of functionality.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel network subsystem issue. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the ip_gre collect metadata vulnerability. Avoid modifying GRE, GRETAP or ERSPAN devices to enable collect metadata mode.

Hi! I’m here to help you understand CVE-2026-98569. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70