SB20261022146 - Improper input validation in Linux kernel ipv4

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261022146

SB20261022146 - Improper input validation in Linux kernel ipv4

Published: October 22, 2026

Security Bulletin ID SB20261022146
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper input validation (CVE-ID: CVE-2026-98569)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local privileged user to cause a denial of service by disrupting metadata receive lookup for GRE, GRETAP, or ERSPAN tunnel devices.

The vulnerability exists due to missing validation of metadata tunnel uniqueness in ipgre_netlink_parms() when enabling collect_md on an existing tunnel device through changelink. A local privileged user can convert a non-metadata device to metadata mode, replacing another device's metadata receive entry of the same type in the same network namespace, and then delete either device to disrupt metadata receive lookup for the surviving device.


Remediation

Install update from vendor's website.

References