In the Linux kernel, the following vulnerability has been resolved: ip_gre: Reject enabling collect metadata through changelink… (CVE-2026-98569)

The Linux kernel ip_gre module had a vulnerability where the ipgre_netlink_parms() function could enable collect_md (metadata collection) on existing GRE, GRETAP, or ERSPAN devices via changelink operations. Unlike newlink, changelink did not enforce uniqueness of metadata tunnels, allowing conversion of a non-metadata device to metadata mode to overwrite the metadata receive entry of another device of the same type in the same network namespace. Deleting either device would clear the shared entry, breaking metadata receive lookups for the remaining device. Additionally, if parameter validation failed after collect_md was set, deleting the modified device could clear an entry it never owned. The fix rejects enabling metadata mode in changelink callbacks before any encapsulation or tunnel parameters are modified, while allowing repeated metadata attribute requests on existing metadata devices.

This vulnerability could cause disruption in metadata receive lookups for GRE, GRETAP, or ERSPAN devices by overwriting or clearing shared metadata entries improperly. This may lead to incorrect or failed metadata processing for surviving devices in the same network namespace. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to reject enabling metadata mode through changelink callbacks before modifying tunnel parameters. Users should update to a Linux kernel version that includes this fix. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or vendor updates for the exact fixed versions and apply the official patches accordingly.