The Linux kernel ipip tunnel implementation in collect_md mode had a flaw where ipip_tunnel_rcv() returned 0 without freeing the skb when ip_tun_rx_dst() failed to allocate metadata_dst. Since ipip_rcv() and mplsip_rcv() are registered as xfrm_tunnel handlers, the upper layers interpreted the zero return as the packet being consumed and did not free the skb, causing a memory leak. Other tunnel drivers correctly free the skb in similar failure scenarios. The fix involves jumping to the existing drop label to free the skb while still returning 0, preserving the expected behavior that the packet is consumed. Triggering this requires an ipip or mplsip tunnel in collect_md mode and an atomic allocation failure, which is rare and explains why the issue was unnoticed.

The vulnerability causes a memory leak in the kernel's networking stack under specific conditions involving ipip or mplsip tunnels in collect_md mode. This leak occurs when metadata_dst allocation fails, potentially leading to resource exhaustion over time if exploited repeatedly. There is no indication of direct code execution or privilege escalation from this issue.

A fix for this vulnerability has been implemented in the Linux kernel by ensuring the skb is freed properly when metadata_dst allocation fails in collect_md mode. Users should apply the official kernel update containing this fix. No additional mitigation is required as the patch addresses the root cause.