{"id":"CVE-2026-98569","kind":"vulnerability","aliases":["CVE-2026-98569"],"related":[],"title":"Linux kernel: GRE tunnel metadata changelink breaks receive lookup for other devices","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nip_gre: Reject enabling collect metadata through changelink\n\nipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP\nor ERSPAN device. Unlike newlink, changelink does not enforce metadata\ntunnel uniqueness. Converting a non-metadata device can therefore\nreplace the metadata receive entry for another device of the same type\nin the same netns. Deleting either device then clears the shared entry,\nbreaking metadata receive lookup for the surviving device.\n\nIf parameter validation fails after collect_md is set, deleting the\nmodified device can also clear an entry it never owned.\n\nReject enabling metadata mode in both changelink callbacks before any\nencapsulation or tunnel parameters are modified. Allow requests that\nrepeat the metadata attribute on an existing metadata device.","summary":"The Linux kernel let an existing GRE, GRETAP or ERSPAN device be switched to metadata (collect_md) mode through changelink, which skipped the uniqueness check that newlink enforces. Converting one device can overwrite and later clear the shared metadata receive entry of another device in the same network namespace, breaking tunnel receive for the surviving device.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gre-tunnels","linux-kernel","networking","runtime","self-hosted"],"not_affected_if":["default-config","no-gre-tunnels"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed by the vendor or NVD entry (unknown in the sources).\n- Run `ip -d link show type gre` and `ip -d link show type gretap` and look for `external` or `collect_metadata` on tunnels.\n- Run `ip -d link show type erspan` to check ERSPAN devices.","fix":"- Update the Linux kernel to a release that includes the upstream fix for ip_gre changelink (fixed version unknown in the sources).\n- Until patched, avoid changing existing GRE, GRETAP or ERSPAN devices to metadata mode with `ip link set ... external` style changes and recreate them instead.","status":"open","published_at":"2026-10-18T16:17:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:16+00:00","updated_at":"2026-10-25T05:23:16+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:23:16Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for ip_gre changelink (fixed version unknown in the sources).\n- Until patched, avoid changing existing GRE, GRETAP or ERSPAN devices to metadata mode with `ip link set ... external` style changes and recreate them instead.","reach":"local","title":"Linux kernel: GRE tunnel metadata changelink breaks receive lookup for other devices","impact":"low","summary":"The Linux kernel let an existing GRE, GRETAP or ERSPAN device be switched to metadata (collect_md) mode through changelink, which skipped the uniqueness check that newlink enforces. Converting one device can overwrite and later clear the shared metadata receive entry of another device in the same network namespace, breaking tunnel receive for the surviving device.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted","networking","gre-tunnels"],"confidence":0.6,"needs_auth":"yes","worst_case":"Tunnel receive lookup breaks for another device; kernel memory state may be affected","analyst_note":"Find the fixed kernel versions and the upstream commit in the NVD or kernel.org stable tree; the sources give no version or severity.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed by the vendor or NVD entry (unknown in the sources).\n- Run `ip -d link show type gre` and `ip -d link show type gretap` and look for `external` or `collect_metadata` on tunnels.\n- Run `ip -d link show type erspan` to check ERSPAN devices.","needs_analyst":true,"not_affected_if":["no-gre-tunnels","default-config"],"who_is_affected":"Hosts that run the Linux kernel with GRE, GRETAP or ERSPAN tunnels, typically routers, hypervisors or hosts using tunnel overlays, where an administrator or a process with network admin rights changes tunnel modes. Systems without GRE, GRETAP or ERSPAN devices, or that do not change tunnel modes after creation, are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000737,"input_tokens":3507,"output_tokens":773,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98569':15A,18A 'allow':205C 'also':182C 'anoth':72B,142C 'attribut':211C 'break':7A,79B,160C 'callback':196C 'changelink':6A,49B,103C,121C,195C 'check':54B 'clear':65B,156C,183C 'collect':45B,100C,109C,173C 'convert':58B,128C 'cve':13A,16A 'delet':152C,177C 'devic':12A,40B,60B,73B,85B,118C,133C,143C,154C,167C,180C,216C 'either':153C 'enabl':99C,108C,190C 'encapsul':199C 'enforc':57B,124C 'entri':70B,140C,159C,185C 'erspan':39B,117C 'exist':35B,113C,214C 'fail':171C 'follow':91C 'gre':3A,20B,36B,97C,114C 'gre-tunnel':19B 'gretap':37B,115C 'host':29B 'ip':96C 'ipgr':104C 'kernel':2A,24B,32B,89C 'later':64B 'let':33B 'linux':1A,23B,31B,88C 'linux-kernel':22B 'lookup':9A,163C 'md':46B,110C,174C 'metadata':5A,44B,68B,101C,125C,132C,138C,161C,191C,210C,215C 'mode':47B,192C 'modifi':179C,204C 'namespac':78B 'netlink':105C 'netn':151C 'network':25B,77B 'never':187C 'newlink':56B,120C 'non':131C 'non-metadata':130C 'one':59B 'overwrit':62B 'own':188C 'paramet':169C,202C 'parm':106C 'receiv':8A,69B,81B,139C,162C 'reject':98C,189C 'repeat':208C 'replac':136C 'request':206C 'resolv':95C 'runtim':26B 'self':28B 'self-host':27B 'set':176C 'share':67B,158C 'skip':51B 'surviv':84B,166C 'switch':42B 'therefor':135C 'tunnel':4A,21B,80B,126C,201C 'type':147C 'uniqu':53B,127C 'unlik':119C 'valid':170C 'vulner':92C","nicknames":[],"mitigations":[],"who_affected":"Hosts that run the Linux kernel with GRE, GRETAP or ERSPAN tunnels, typically routers, hypervisors or hosts using tunnel overlays, where an administrator or a process with network admin rights changes tunnel modes. Systems without GRE, GRETAP or ERSPAN devices, or that do not change tunnel modes after creation, are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98569","severity":null,"published_at":"2026-10-18T16:17:09+00:00","modified_at":"2026-10-19T10:19:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}