CVE-2026-98569

What the bug is

ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a non-metadata device can therefore replace the metadata receive entry for another device of the same type in the same netns. Deleting either device then clears the shared entry, breaking metadata receive lookup for the surviving device. If parameter validation fails after collect_md is set, deleting the modified device can also clear an entry it never owned. Reject enabling metadata mode in both changelink callbacks before any encapsulation or tunnel parameters are modified. Allow requests that repeat the metadata attribute on an existing metadata device.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/ipv4/ip_gre.c

What this is

NETWORKING [IPv4/IPv6]MAINTAINERS section matched on net/ipv4/ip* · netdev@vger.kernel.org · Maintained

Kernel module

ip_gre

Check it on the machine

grep -wE 'CONFIG_INET|CONFIG_NET_IPGRE' /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w ip_gre

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.

• bookworm, trixie, forky, sidm

m

a loadable module on every flavour - check lsmod, can be blacklisted

Build switches

CONFIG_INET, CONFIG_NET_IPGRE

Reads as

all on means the file is compiled; any one off means it is not.

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-10-18 (today)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

not scored

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

net/ipv4

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
4.3	5.10.271	c80315da8499
4.3	5.15.222	cff8b520312e
4.3	6.1.189	1dc759571f3d
4.3	6.6.158	da2e0cfbb620
4.3	6.12.112	2e54d53b65e2
4.3	6.18.55	bdd41b96e814
4.3	7.2.9	63c5e48d6f7f
4.3	7.3	a3f315be9d30