CVE-2026-98569
Status: ReceivedUnscored—
Severity—Unscored
Exploitation probability0.21 %higher than 11% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
In the Linux kernel, the following vulnerability has been resolved:
ip_gre: Reject enabling collect metadata through changelink
ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a non-metadata device can therefore replace the metadata receive entry for another device of the same type in the same netns. Deleting either device then clears the shared entry, breaking metadata receive lookup for the surviving device.
If parameter validation fails after collect_md is set, deleting the modified device can also clear an entry it never owned.
Read full descriptionShow less
Reject enabling metadata mode in both changelink callbacks before any encapsulation or tunnel parameters are modified. Allow requests that repeat the metadata attribute on an existing metadata device.
CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.21 %
- Percentile among all scored CVEs
- 11
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
Show 8 references
- https://git.kernel.org/stable/c/1dc759571f3df14891175fc52527f7624ba01322
- https://git.kernel.org/stable/c/2e54d53b65e296b4b4bdc2cdd3b2b58dfa8d8c5c
- https://git.kernel.org/stable/c/63c5e48d6f7f5722a48f63e13e961dc5302894ed
- https://git.kernel.org/stable/c/a3f315be9d30eeb6938d11fa17fd4b32d52f7c42
- https://git.kernel.org/stable/c/bdd41b96e814300c66222cf4e47ecb8aef995656
- https://git.kernel.org/stable/c/c80315da84998b69b8829785a174b0bf72a81992
- https://git.kernel.org/stable/c/cff8b520312e750ad38967c30128e1534cbf9484
- https://git.kernel.org/stable/c/da2e0cfbb620b199927a1e5b93b7cfde32083c7d
Raw JSON (NVD)
Show
{
"id": "CVE-2026-98569",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "c80315da84998b69b8829785a174b0bf72a81992",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "cff8b520312e750ad38967c30128e1534cbf9484",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "1dc759571f3df14891175fc52527f7624ba01322",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "da2e0cfbb620b199927a1e5b93b7cfde32083c7d",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "2e54d53b65e296b4b4bdc2cdd3b2b58dfa8d8c5c",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "bdd41b96e814300c66222cf4e47ecb8aef995656",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "63c5e48d6f7f5722a48f63e13e961dc5302894ed",
"versionType": "git"
},
{
"status": "affected",
"version": "2e15ea390e6f4466655066d97e22ec66870a042c",
"lessThan": "a3f315be9d30eeb6938d11fa17fd4b32d52f7c42",
"versionType": "git"
}
],
"programFiles": [
"net/ipv4/ip_gre.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv4/ip_gre.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:09.113",
"references": [
{
"url": "https://git.kernel.org/stable/c/1dc759571f3df14891175fc52527f7624ba01322",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2e54d53b65e296b4b4bdc2cdd3b2b58dfa8d8c5c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/63c5e48d6f7f5722a48f63e13e961dc5302894ed",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a3f315be9d30eeb6938d11fa17fd4b32d52f7c42",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bdd41b96e814300c66222cf4e47ecb8aef995656",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c80315da84998b69b8829785a174b0bf72a81992",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cff8b520312e750ad38967c30128e1534cbf9484",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/da2e0cfbb620b199927a1e5b93b7cfde32083c7d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip_gre: Reject enabling collect metadata through changelink\n\nipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP\nor ERSPAN device. Unlike newlink, changelink does not enforce metadata\ntunnel uniqueness. Converting a non-metadata device can therefore\nreplace the metadata receive entry for another device of the same type\nin the same netns. Deleting either device then clears the shared entry,\nbreaking metadata receive lookup for the surviving device.\n\nIf parameter validation fails after collect_md is set, deleting the\nmodified device can also clear an entry it never owned.\n\nReject enabling metadata mode in both changelink callbacks before any\nencapsulation or tunnel parameters are modified. Allow requests that\nrepeat the metadata attribute on an existing metadata device."
}
],
"lastModified": "2026-10-19T10:19:14.887",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}