CVE-2026-98569 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
ip_gre: Reject enabling collect metadata through changelink
ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a non-metadata device can therefore replace the metadata receive entry for another device of the same type in the same netns. Deleting either device then clears the shared entry, breaking metadata receive lookup for the surviving device.
If parameter validation fails after collect_md is set, deleting the modified device can also clear an entry it never owned.
Reject enabling metadata mode in both changelink callbacks before any encapsulation or tunnel parameters are modified. Allow requests that repeat the metadata attribute on an existing metadata device.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel vulnerability identified within the ip_gre subsystem represents a critical logic flaw in how network interface configurations are updated via netlink operations, specifically affecting Generic Routing Encapsulation (GRE), GRETAP, and ERSPAN tunnel devices. The core issue stems from an inconsistency between the validation procedures applied during device creation versus those applied when modifying existing devices through changelink callbacks. When a user or administrative process attempts to enable collect_md mode on an already established GRE-type interface using ipgre_netlink_parms(), the kernel fails to enforce metadata tunnel uniqueness constraints that are strictly enforced during initial device instantiation via newlink operations. This discrepancy allows for the creation of conflicting state configurations within the network namespace, leading to potential denial of service conditions and unexpected behavior in packet processing pipelines.
The operational impact of this flaw is significant because it disrupts the integrity of metadata receive lookups which are essential for proper tunneling functionality. By allowing a non-metadata device to be converted into one that collects metadata without verifying uniqueness against existing entries, the system effectively overwrites or shares the metadata receive entry with another device of the same type within the same network namespace. This shared state creates a fragile dependency where the deletion of either the original device or the newly modified device results in the clearing of the shared entry. Consequently, the surviving device loses its ability to perform correct metadata receive lookups, effectively breaking tunneling functionality for that interface and potentially causing packet drops or misrouting depending on the specific traffic patterns and application dependencies involved.
Furthermore, the vulnerability extends beyond simple state conflicts due to a secondary failure mode related to parameter validation sequencing. If the configuration change request includes parameters that fail subsequent validation checks after collect_md has already been set, the kernel may proceed with partial modifications before rolling back or rejecting the entire operation. In such scenarios, deleting the modified device can inadvertently clear metadata entries that were never legitimately owned by that specific interface instance. This behavior introduces a risk of clearing critical routing or tunneling state for other active devices, leading to broader network instability and potential denial of service conditions across multiple interfaces within the affected namespace.
To mitigate this vulnerability, the kernel developers have implemented a fix that rejects enabling metadata mode during changelink callbacks before any encapsulation or tunnel parameters are modified. This ensures that uniqueness checks are performed at the earliest possible stage of configuration change processing, preventing invalid states from ever being established in memory. The patch also allows requests that simply repeat the existing metadata attribute on an already configured metadata device to proceed without triggering unnecessary validation errors, thereby maintaining backward compatibility while closing the security gap. Administrators and developers should ensure their systems are updated with this kernel fix to prevent unauthorized or accidental disruption of GRE-based tunneling services.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation as it involves insufficient checking of input parameters during state transitions in network device configuration. It also relates to CWE-674 Uncontrolled Resource Consumption because the flawed logic can lead to resource conflicts and denial of service through broken metadata lookups. In terms of adversary behavior, this flaw could be leveraged within ATT&CK technique T1089 Disabling or Modifying Tools if an attacker with local access seeks to disrupt network monitoring capabilities by breaking tunneling infrastructure that feeds security telemetry data. The fix emphasizes the importance of consistent validation logic across all code paths handling device configuration changes in complex networking subsystems like ip_gre.