CVE-2026-31429

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: skb: fix cross-cache free of KFENCE-allocated skb head

SKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2

value (e.g. 704 on x86_64) to avoid collisions with generic kmalloc

bucket sizes. This ensures that skb_kfree_head() can reliably use

skb_end_offset to distinguish skb heads allocated from

skb_small_head_cache vs. generic kmalloc caches.

However, when KFENCE is enabled, kfence_ksize() returns the exact

requested allocation size instead of the slab bucket size. If a caller

(e.g. bpf_test_init) allocates skb head data via kzalloc() and the

requested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then

slab_build_skb() -> ksize() returns that exact value. After subtracting

skb_shared_info overhead, skb_end_offset ends up matching

SKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free

the object to skb_small_head_cache instead of back to the original

kmalloc cache, resulting in a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References