CVE-2026-31429

Root

Cause The vulnerability arises because the kernel's skb allocation uses a custom slab cache (skb_small_head_cache) sized to a non-power-of-2 value to avoid collisions with generic kmalloc caches. When Kernel Electric-Fence (KFENCE) is enabled, kfence_ksize() returns the exact requested allocation size instead of the slab bucket size. If an allocation (e.g., from bpf_test_init) requests a size that equals SKB_SMALL_HEAD_CACHE_SIZE, then ksize() returns that exact value, causing skb_end_offset to match SKB_SMALL_HEAD_HEADROOM. Consequently, skb_kfree_head() incorrectly frees the object to skb_small_head_cache instead of the original kmalloc cache, leading to a slab cross-cache free [1].

Attack

Vector Exploitation requires the system to have KFENCE enabled and a caller to allocate skb head data with a size exactly matching SKB_SMALL_HEAD_CACHE_SIZE. The trigger is demonstrated via bpf_test_init, but other similar callers might also be affected. No special privileges are needed; the attacker must be able to trigger such an allocation, likely from user space or BPF program.

Impact

A cross-cache free corrupts kernel memory, potentially leading to system crashes, data corruption, or privilege escalation. The bug is classified as medium severity (CVSS 5.5) due to the requirement of KFENCE being enabled and specific allocation conditions.

Mitigation

The fix, committed in kernel stable branches, changes skb_kfree_head() to always call kfree(head) instead of attempting cache-specific freeing. This keeps the free path generic and avoids allocator-specific misclassification for KFENCE objects. Patches are available for multiple stable kernel versions [1][2][3][4].