A netlink changelink request on the Linux kernel’s ip_gre driver can enable the collect_md flag on an existing GRE, GRETAP, or ERSPAN device without enforcing the uniqueness of metadata tunnels. The change may overwrite the metadata receive entry of another device of the same type in the same network namespace. When either device is later deleted, the shared entry is cleared, causing a metadata lookup failure for the remaining device. If parameter validation fails after collect_md is set, deleting the device may also remove an entry it never owned. The result is the loss of proper metadata handling, which can lead to incorrect packet processing and a denial of service for traffic that relies on GRE metadata.

The flaw affects all Linux kernel implementations that include the ip_gre driver, as indicated by the Linux:Linux vendor string. No specific kernel version is listed, so the issue is present in every kernel revision until the fix is applied.

The CVSS score is 4.4, indicating moderate severity. The EPSS score is less than 1%, showing a very low yet nonzero probability of exploitation. The vulnerability is not listed in CISA KEV. Based on the description, it is inferred that the attacker must have privileged netlink access to issue changelink commands; therefore, the likely attack vector is a locally privileged user or a compromised process. No publicly known exploits exist, but the potential for service disruption in environments that use GRE metadata makes this a concern. The overall risk is moderate to high for systems with GRE tunnels, unless netlink privileges are tightly contained.