---
id: "CVE-2026-98569"
kind: "vulnerability"
aliases: ["CVE-2026-98569"]
title: "Linux kernel: GRE tunnel metadata changelink breaks receive lookup for other devices"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["gre-tunnels", "linux-kernel", "networking", "runtime", "self-hosted"]
not_affected_if: ["default-config", "no-gre-tunnels"]
published_at: "2026-10-18T16:17:09+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:23:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98569", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel: GRE tunnel metadata changelink breaks receive lookup for other devices

The Linux kernel let an existing GRE, GRETAP or ERSPAN device be switched to metadata (collect_md) mode through changelink, which skipped the uniqueness check that newlink enforces. Converting one device can overwrite and later clear the shared metadata receive entry of another device in the same network namespace, breaking tunnel receive for the surviving device.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel versions listed by the vendor or NVD entry (unknown in the sources).
- Run `ip -d link show type gre` and `ip -d link show type gretap` and look for `external` or `collect_metadata` on tunnels.
- Run `ip -d link show type erspan` to check ERSPAN devices.

## Fix

- Update the Linux kernel to a release that includes the upstream fix for ip_gre changelink (fixed version unknown in the sources).
- Until patched, avoid changing existing GRE, GRETAP or ERSPAN devices to metadata mode with `ip link set ... external` style changes and recreate them instead.

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98569

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

ip_gre: Reject enabling collect metadata through changelink

ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP
or ERSPAN device. Unlike newlink, changelink does not enforce metadata
tunnel uniqueness. Converting a non-metadata device can therefore
replace the metadata receive entry for another device of the same type
in the same netns. Deleting either device then clears the shared entry,
breaking metadata receive lookup for the surviving device.

If parameter validation fails after collect_md is set, deleting the
modified device can also clear an entry it never owned.

Reject enabling metadata mode in both changelink callbacks before any
encapsulation or tunnel parameters are modified. Allow requests that
repeat the metadata attribute on an existing metadata device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_