diff --git a/sys/netproto/mpls/mpls_input.c b/sys/netproto/mpls/mpls_input.c
index 445aee9e..14bd5e9e 100644
--- a/sys/netproto/mpls/mpls_input.c
+++ b/sys/netproto/mpls/mpls_input.c
@@ -199,6 +199,12 @@ mpls_forward(struct mbuf *m)
 		rtalloc(cache_rt);
 		if (cache_rt->ro_rt == NULL) {
 			/* route not found */
+			/*
+			 * DF-3468: mpls_forward() owns the packet here --
+			 * free it, otherwise every unroutable MPLS packet
+			 * permanently leaks its mbuf + cluster.
+			 */
+			m_freem(m);
 			return;
 		}
 	}