CVE-2026-98569

ip_gre: Reject enabling collect metadata through changelink

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ip_gre: Reject enabling collect metadata through changelink

ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a non-metadata device can therefore replace the metadata receive entry for another device of the same type in the same netns. Deleting either device then clears the shared entry, breaking metadata receive lookup for the surviving device.

If parameter validation fails after collect_md is set, deleting the modified device can also clear an entry it never owned.

Reject enabling metadata mode in both changelink callbacks before any encapsulation or tunnel parameters are modified. Allow requests that repeat the metadata attribute on an existing metadata device.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2e15ea390e6f4466655066d97e22ec66870a042c to before c80315da84998b69b8829785a174b0bf72a81992Affected 2e15ea390e6f4466655066d97e22ec66870a042c to before cff8b520312e750ad38967c30128e1534cbf9484Affected 2e15ea390e6f4466655066d97e22ec66870a042c to before 1dc759571f3df14891175fc52527f7624ba01322Affected 2e15ea390e6f4466655066d97e22ec66870a042c to before da2e0cfbb620b199927a1e5b93b7cfde32083c7dAffected 2e15ea390e6f4466655066d97e22ec66870a042c to before 2e54d53b65e296b4b4bdc2cdd3b2b58dfa8d8c5cAffected 2e15ea390e6f4466655066d97e22ec66870a042c to before bdd41b96e814300c66222cf4e47ecb8aef995656Affected 2e15ea390e6f4466655066d97e22ec66870a042c to before 63c5e48d6f7f5722a48f63e13e961dc5302894edAffected 2e15ea390e6f4466655066d97e22ec66870a042c to before a3f315be9d30eeb6938d11fa17fd4b32d52f7c42Affected
LinuxLinux	4.3Affected before 4.3Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

2e15ea390e6f4466655066d97e22ec66870a042c to before c80315da84998b69b8829785a174b0bf72a81992Affected
2e15ea390e6f4466655066d97e22ec66870a042c to before cff8b520312e750ad38967c30128e1534cbf9484Affected
2e15ea390e6f4466655066d97e22ec66870a042c to before 1dc759571f3df14891175fc52527f7624ba01322Affected
2e15ea390e6f4466655066d97e22ec66870a042c to before da2e0cfbb620b199927a1e5b93b7cfde32083c7dAffected
2e15ea390e6f4466655066d97e22ec66870a042c to before 2e54d53b65e296b4b4bdc2cdd3b2b58dfa8d8c5cAffected
2e15ea390e6f4466655066d97e22ec66870a042c to before bdd41b96e814300c66222cf4e47ecb8aef995656Affected
2e15ea390e6f4466655066d97e22ec66870a042c to before 63c5e48d6f7f5722a48f63e13e961dc5302894edAffected
2e15ea390e6f4466655066d97e22ec66870a042c to before a3f315be9d30eeb6938d11fa17fd4b32d52f7c42Affected

LinuxLinux

4.3Affected
before 4.3Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.