CVE-2026-89565

In the Linux kernel, the following vulnerability has been resolved:

ipip: fix skb leak in collect md mode when metadata dst allocation fails

In collect md mode ipip tunnel rcv() returns 0 without freeing the skb when ip tun rx dst() fails to allocate the metadata dst. ipip rcv() and mplsip rcv() are registered as xfrm tunnel handlers, so tunnel4 rcv() and tunnelmpls4 rcv() read the zero return as "the packet has been consumed" and do not free it either. The skb is leaked.

The other tunnel drivers all dispose of the packet at this point: ip6 tunnel.c jumps to its drop label, ip gre.c and ip6 gre.c return PACKET REJECT, which makes gre rcv() free the skb. Only ipip returns 0.

Jump to the existing drop label instead. It frees the skb and still returns 0, so the packet keeps being reported as consumed, which is what we want here: the outer header has already been pulled, and neither the remaining handlers nor an ICMP unreachable have any use for it.

Triggering this needs an ipip or mplsip tunnel in collect md mode and an atomic allocation failure, which is why it has gone unnoticed.