Cloudanix VulnDB

CVE-2026-98569

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux network tunnel handling can let one tunnel device accidentally take over or break another tunnel's ability to receive traffic, potentially disrupting network connections.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The ipgre_netlink_parms() function allows collect_md to be enabled on an existing GRE/GRETAP/ERSPAN device via changelink without enforcing metadata tunnel uniqueness, allowing replacement of a shared metadata receive entry; subsequent device deletion can then clear the entry for a surviving device or an entry never owned by the deleted device.

Why it matters to the business

Organizations running Linux kernels with GRE, GRETAP or ERSPAN tunnels face risk of sudden metadata receive lookup failures that can interrupt overlay networking, causing traffic blackholing or misdelivery with low but non-zero probability of exploitation given the five-day-old disclosure and stable low EPSS.

How an attack unfolds

An attacker with sufficient privileges to issue netlink changelink operations on tunnel devices crafts a request that sets collect_md on a non-metadata GRE device, causing it to claim the metadata receive slot of another device in the same namespace; deleting either device then corrupts the shared entry, breaking metadata reception for the remaining tunnel.

How to fix it

Upgrade to a kernel containing the fix that rejects enabling collect_md via changelink in both ipgre_changelink and erspan_changelink before any parameter changes; apply the patch that adds the early rejection of metadata mode on existing devices.

How to confirm the fix worked

Confirm the fix is present by checking that attempts to enable collect_md on an existing non-metadata GRE device via ip link change are rejected with an error; verify no duplicate metadata receive entries exist for the same netns after device modifications.

Typical attack path

  1. Obtain netlink privileges sufficient to modify tunnel interfaces
  2. Identify an existing non-metadata GRE/GRETAP/ERSPAN device sharing a namespace with a metadata device
  3. Issue a changelink request enabling collect_md on the non-metadata device
  4. Trigger deletion of either the modified or the original metadata device
  5. Observe or exploit the resulting metadata receive lookup failure on the surviving device

How to detect it

Review kernel logs for netlink changelink operations on GRE devices that set collect_md; look for subsequent deletion events followed by metadata receive lookup failures or tunnel traffic drops in the same network namespace.

What your security team should do

  • Prioritize kernel updates on systems using GRE, GRETAP or ERSPAN metadata tunnels within the next patch cycle
  • Audit netlink permissions for untrusted users or containers that can modify tunnel devices
  • Monitor for unexpected metadata tunnel conflicts via kernel logs after tunnel reconfiguration

The record

In the Linux kernel, the following vulnerability has been resolved: ip_gre: Reject enabling collect metadata through changelink ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a non-metadata device can therefore replace the metadata receive entry for another device of the same type in the same netns. Deleting either device then clears the shared entry, breaking metadata receive lookup for the surviving device. If parameter validation fails after collect_md is set, deleting the modified device can also clear an entry it never owned. Reject enabling metadata mode in both changelink callbacks before any encapsulation or tunnel parameters are modified. Allow requests that repeat the metadata attribute on an existing metadata device.

Affected packages

Ecosystem Package Introduced Fixed