CVE-2026-89565 Overview
CVE-2026-89565 is a memory leak vulnerability in the Linux kernel's IP-in-IP (ipip) tunnel driver. The flaw resides in ipip_tunnel_rcv() when the tunnel operates in collect_md mode. When ip_tun_rx_dst() fails to allocate the metadata_dst structure, the function returns 0 without freeing the socket buffer (skb). The upstream xfrm tunnel handlers (tunnel4_rcv() and tunnelmpls4_rcv()) interpret a zero return value as "packet consumed" and also skip the free, resulting in a leaked skb on every failed reception.
Critical Impact
Sustained atomic allocation failures on hosts running ipip or mplsip tunnels in collect_md mode cause progressive kernel memory exhaustion, degrading system stability over time.
Affected Products
- Linux kernel versions containing the vulnerable ipip_tunnel_rcv() code path in net/ipv4/ipip.c
- Systems configured with ipip tunnels in collect_md mode
- Systems configured with mplsip tunnels using the shared xfrm tunnel dispatch
Discovery Timeline
- 2026-09-11 - CVE-2026-89565 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89565
Vulnerability Analysis
The defect is a classic memory leak triggered by an unhandled error path. In collect_md mode, ipip_tunnel_rcv() invokes ip_tun_rx_dst() to allocate a metadata_dst object that carries per-packet tunnel metadata. When allocation fails under memory pressure, the function returns 0 immediately, bypassing the drop path that would normally free the skb.
Because ipip_rcv() and mplsip_rcv() are registered as xfrm_tunnel handlers, the callers tunnel4_rcv() and tunnelmpls4_rcv() treat a zero return as an indication that the packet has been consumed. Neither the caller nor the receive routine releases the buffer. Comparable tunnel drivers behave correctly: ip6_tunnel.c jumps to a drop label, while ip_gre.c and ip6_gre.c return PACKET_REJECT, causing gre_rcv() to free the skb.
Root Cause
The root cause is inconsistent error handling in ipip_tunnel_rcv(). The function exits on allocation failure without jumping to the existing drop label. The corrected patch jumps to drop, which frees the skb and still returns 0, preserving the "packet consumed" semantics expected by the xfrm dispatch. The outer header has already been pulled at this point, so neither remaining handlers nor an ICMP unreachable response can meaningfully use the buffer.
Attack Vector
Triggering the leak requires an ipip or mplsip tunnel configured in collect_md mode and an atomic memory allocation failure inside ip_tun_rx_dst(). The condition is difficult to induce deliberately from the network, which is why the defect remained undetected. However, on long-running systems experiencing sustained memory pressure, each failed allocation permanently loses one skb, contributing to gradual resource exhaustion and potential denial of service. The vulnerability is described in prose only; refer to the linked kernel commits for the exact source-level fix.
Detection Methods for CVE-2026-89565
Indicators of Compromise
- Steady growth in kernel skb allocations reported by /proc/slabinfo (skbuff_head_cache, skbuff_fclone_cache) on hosts using ipip or mplsip tunnels.
- Elevated memory allocation failure counters in dmesg or /proc/vmstat (allocstall, pgalloc_* anomalies) correlated with tunnel traffic.
- Unexplained reduction in available kernel memory on systems running lightweight tunnel (LWT) configurations with collect_md.
Detection Strategies
- Audit running kernels against the fixed commits (1909df2, 31e4be2, 6776efe, 6d8c5b2, c4dc23d, fd01f1a) to confirm the patch is applied.
- Enumerate tunnel devices with ip -d link show type ipip and ip -d link show type mplsip, flagging any device with the external (collect_md) flag set.
- Correlate slab growth metrics with tunnel receive counters (ip -s link) to identify hosts where leaked buffers accumulate under load.
Monitoring Recommendations
- Continuously track /proc/meminfoSlab and SReclaimable values on tunnel gateways and alert on abnormal upward trends.
- Enable kmemleak in staging kernels to catch residual skb allocations attributed to ipip_tunnel_rcv.
- Ship kernel logs and memory telemetry to a centralized data lake for longitudinal analysis of tunnel-related resource consumption.
How to Mitigate CVE-2026-89565
Immediate Actions Required
- Inventory all Linux hosts that terminate ipip or mplsip tunnels in collect_md mode, including OVS, eBPF, and LWT-based deployments.
- Schedule kernel upgrades to a version containing one of the fix commits referenced in the kernel.org stable tree.
- Monitor slab consumption on unpatched hosts and plan reboots before resource exhaustion impacts availability.
Patch Information
The fix routes the allocation failure to the existing drop label in ipip_tunnel_rcv(), ensuring the skb is freed while still returning 0 to the xfrm dispatch layer. Patches are available in the stable tree via Linux Kernel Commit 1909df2, Linux Kernel Commit 31e4be2, Linux Kernel Commit 6776efe, Linux Kernel Commit 6d8c5b2, Linux Kernel Commit c4dc23d, and Linux Kernel Commit fd01f1a.
Workarounds
- Where feasible, disable collect_md mode on ipip and mplsip tunnels until the patched kernel is deployed.
- Increase minimum free memory reserves (vm.min_free_kbytes) to reduce the likelihood of atomic allocation failures.
- Restrict untrusted ingress to tunnel interfaces so an attacker cannot amplify traffic that would trigger repeated allocation attempts.
# Verify installed kernel and inspect ipip/mplsip tunnels for collect_md (external) mode
uname -r
ip -d link show type ipip | grep -E 'ipip|external'
ip -d link show type mplsip | grep -E 'mplsip|external'
# Raise reserved memory to reduce atomic allocation failures
sysctl -w vm.min_free_kbytes=131072
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
