UBUNTU-CVE-2026-89565: High severity ubuntu/linux-azure vulnerability

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collectmd mode when metadatadst allocation fails In collectmd mode ipiptunnelrcv() returns 0 without freeing the skb when iptunrxdst() fails to allocate the metadatadst. ipiprcv() and mplsiprcv() are registered as xfrmtunnel handlers, so tunnel4rcv() and tunnelmpls4rcv() read the zero return as "the packet has been consumed" and do not free it either. The skb is leaked. The other tunnel drivers all dispose of the packet at this point: ip6tunnel.c jumps to its drop label, ipgre.c and ip6gre.c return PACKETREJECT, which makes grercv() free the skb. Only ipip returns 0. Jump to the existing drop label instead. It frees the skb and still returns 0, so the packet keeps being reported as consumed, which is what we want here: the outer header has already been pulled, and neither the remaining handlers nor an ICMP unreachable have any use for it. Triggering this needs an ipip or mplsip tunnel in collectmd mode and an atomic allocation failure, which is why it has gone unnoticed.