Executive brief
The Linux kernel's IPIP tunnel implementation contains a memory leak when operating in collect_md mode and an allocation failure occurs. In this scenario, network packets (skb) are not properly freed, causing memory to accumulate over time and potentially degrading system performance or availability. This issue requires a specific configuration (IPIP or MPLSIP tunnel in collect_md mode) combined with a rare memory allocation failure to trigger.
Technical details
The vulnerability is a resource leak in the ipip_tunnel_rcv() and mplsip_rcv() functions in the Linux kernel's IP-in-IP tunneling code. When collect_md mode is enabled and the ip_tun_rx_dst() call fails to allocate memory for metadata_dst, the function returns 0 without freeing the socket buffer (skb). Since these functions are registered as xfrm_tunnel handlers, the calling code (tunnel4_rcv/tunnelmpls4_rcv) interprets the zero return value as indicating the packet was consumed and does not perform cleanup, resulting in a leaked skb. The fix changes the error path to jump to the existing drop label, which properly frees the skb while maintaining the correct return semantics. The vulnerability requires both a tunnel in collect_md mode and an atomic memory allocation failure, making exploitation conditions restrictive.
Affected products
- Linux Linux kernel multiple versions with collect_md mode support (approximately Linux 4.0 and later, based on cfc7381b3002 fix reference)
Timeline
- 2026-09-11: disclosed: Vulnerability published and assigned CVE-2026-89565
- 2026-08-19: patched: Fix authored by Anton Danilov
- 2026-09-07: patched: Patch committed to stable kernel branches
- 2026-09-14: patched: Patch merged by Greg Kroah-Hartman