CVE-2026-98569
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
ip_gre: Rechazar la activación de la recopilación de metadatos mediante changelink
ipgre_netlink_parms() puede activar collect_md en un dispositivo GRE, GRETAP o ERSPAN existente. A diferencia de newlink, changelink no garantiza la unicidad de los túneles con metadatos. Por tanto, convertir un dispositivo sin metadatos puede sustituir la entrada de recepción de metadatos de otro dispositivo del mismo tipo en el mismo netns. Al eliminar cualquiera de los dos dispositivos se borra la entrada compartida, lo que rompe la búsqueda de recepción de metadatos del dispositivo que queda.
Leer descripción completaMostrar menos
Si la validación de parámetros falla después de establecer collect_md, eliminar el dispositivo modificado también puede borrar una entrada que nunca le perteneció.
Rechazar la activación del modo de metadatos en ambas funciones de retrollamada de changelink antes de modificar cualquier parámetro de encapsulado o de túnel. Permitir las solicitudes que repitan el atributo de metadatos en un dispositivo con metadatos existente.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/1dc759571f3df14891175fc52527f7624ba01322
- https://git.kernel.org/stable/c/2e54d53b65e296b4b4bdc2cdd3b2b58dfa8d8c5c
- https://git.kernel.org/stable/c/63c5e48d6f7f5722a48f63e13e961dc5302894ed
- https://git.kernel.org/stable/c/a3f315be9d30eeb6938d11fa17fd4b32d52f7c42
- https://git.kernel.org/stable/c/bdd41b96e814300c66222cf4e47ecb8aef995656
- https://git.kernel.org/stable/c/c80315da84998b69b8829785a174b0bf72a81992
- https://git.kernel.org/stable/c/cff8b520312e750ad38967c30128e1534cbf9484
- https://git.kernel.org/stable/c/da2e0cfbb620b199927a1e5b93b7cfde32083c7d
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98569",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "c80315da84998b69b8829785a174b0bf72a81992",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "cff8b520312e750ad38967c30128e1534cbf9484",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "1dc759571f3df14891175fc52527f7624ba01322",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "da2e0cfbb620b199927a1e5b93b7cfde32083c7d",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "2e54d53b65e296b4b4bdc2cdd3b2b58dfa8d8c5c",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "bdd41b96e814300c66222cf4e47ecb8aef995656",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "63c5e48d6f7f5722a48f63e13e961dc5302894ed",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "a3f315be9d30eeb6938d11fa17fd4b32d52f7c42",
"versionType": "git"
}
],
"programFiles": [
"net/ipv4/ip_gre.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv4/ip_gre.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:09.113",
"references": [
{
"url": "https://git.kernel.org/stable/c/1dc759571f3df14891175fc52527f7624ba01322",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2e54d53b65e296b4b4bdc2cdd3b2b58dfa8d8c5c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/63c5e48d6f7f5722a48f63e13e961dc5302894ed",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a3f315be9d30eeb6938d11fa17fd4b32d52f7c42",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bdd41b96e814300c66222cf4e47ecb8aef995656",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c80315da84998b69b8829785a174b0bf72a81992",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cff8b520312e750ad38967c30128e1534cbf9484",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/da2e0cfbb620b199927a1e5b93b7cfde32083c7d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip_gre: Reject enabling collect metadata through changelink\n\nipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP\nor ERSPAN device. Unlike newlink, changelink does not enforce metadata\ntunnel uniqueness. Converting a non-metadata device can therefore\nreplace the metadata receive entry for another device of the same type\nin the same netns. Deleting either device then clears the shared entry,\nbreaking metadata receive lookup for the surviving device.\n\nIf parameter validation fails after collect_md is set, deleting the\nmodified device can also clear an entry it never owned.\n\nReject enabling metadata mode in both changelink callbacks before any\nencapsulation or tunnel parameters are modified. Allow requests that\nrepeat the metadata attribute on an existing metadata device."
}
],
"lastModified": "2026-10-19T10:19:14.887",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}