CVE-2026-98569

In the Linux kernel, the following vulnerability has been resolved: ip_gre: Reject enabling collect metadata through changelink ipgre_netlink_parms() can enable collect_md on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a non-metadata device can therefore replace the metadata receive entry for another device of the same type in the same netns. Deleting either device then clears the shared entry, breaking metadata receive lookup for the surviving device. If parameter validation fails after collect_md is set, deleting the modified device can also clear an entry it never owned. Reject enabling metadata mode in both changelink callbacks before any encapsulation or tunnel parameters are modified. Allow requests that repeat the metadata attribute on an existing metadata device.

• https://git.kernel.org/stable/c/1dc759571f3df14891175fc52527f7624ba01322
• https://git.kernel.org/stable/c/2e54d53b65e296b4b4bdc2cdd3b2b58dfa8d8c5c
• https://git.kernel.org/stable/c/63c5e48d6f7f5722a48f63e13e961dc5302894ed
• https://git.kernel.org/stable/c/a3f315be9d30eeb6938d11fa17fd4b32d52f7c42
• https://git.kernel.org/stable/c/bdd41b96e814300c66222cf4e47ecb8aef995656
• https://git.kernel.org/stable/c/c80315da84998b69b8829785a174b0bf72a81992
• https://git.kernel.org/stable/c/cff8b520312e750ad38967c30128e1534cbf9484
• https://git.kernel.org/stable/c/da2e0cfbb620b199927a1e5b93b7cfde32083c7d

Published

Oct 18, 2026

Last Modified

Oct 19, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-98563In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98564In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98565In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98566In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98567In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98568In the Linux kernel, the following vulnerability has been re…
• CVE-2026-9857The Invoice123 plugin for WordPress is vulnerable to authori…4.3
• CVE-2026-98570In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98571In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98572In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98573In the Linux kernel, the following vulnerability has been re…
• CVE-2026-98574In the Linux kernel, the following vulnerability has been re…