When an IPIP or MPLSIP tunnel operating in collect_md mode cannot allocate the metadata_dst structure, the receive routine returns 0 without freeing the socket buffer. The surrounding tunnel handlers treat a zero return as a consumed packet and likewise do not release the skb. This results in a kernel memory leak (CWE‑772) that, if repeated, could exhaust kernel memory and lead to out‑of‑memory conditions or a denial‑of‑service for the host. The CVSS score of 5.9 indicates moderate severity once the allocation failure condition is met.

All Linux kernel releases built before the inclusion of the fix for the IPIP tunnel receive leak are vulnerable. The vulnerability applies to any system that runs an IPIP or MPLSIP tunnel configured in collect_md mode using these kernels, regardless of distribution or vendor. Specific kernel versions are not enumerated in the advisory, so any pre‑patched kernel should be considered affected.

Exploitation requires an attacker who can deliver crafted IPIP or MPLSIP traffic to a host with a tunnel in collect_md mode and trigger a rare allocation failure. The EPSS score is below 1% and the vulnerability is not listed in CISA KEV, indicating that it has not been widely exploited. The moderate CVSS score suggests that, if the exploit condition is satisfied, an attacker could cause memory exhaustion, but the high barrier to exploitation keeps the overall risk relatively low.