PT-2026-33746 · Linux · Linux

Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-31429

NVD

In the Linux kernel, the following vulnerability has been resolved:

net: skb: fix cross-cache free of KFENCE-allocated skb head

SKB SMALL HEAD CACHE SIZE is intentionally set to a non-power-of-2 value (e.g. 704 on x86 64) to avoid collisions with generic kmalloc bucket sizes. This ensures that skb kfree head() can reliably use skb end offset to distinguish skb heads allocated from skb small head cache vs. generic kmalloc caches.

However, when KFENCE is enabled, kfence ksize() returns the exact requested allocation size instead of the slab bucket size. If a caller (e.g. bpf test init) allocates skb head data via kzalloc() and the requested size happens to equal SKB SMALL HEAD CACHE SIZE, then slab build skb() -> ksize() returns that exact value. After subtracting skb shared info overhead, skb end offset ends up matching SKB SMALL HEAD HEADROOM, causing skb kfree head() to incorrectly free the object to skb small head cache instead of back to the original kmalloc cache, resulting in a slab cross-cache free:

kmem cache free(skbuff small head): Wrong slab cache. Expected skbuff small head but got kmalloc-1k

Fix this by always calling kfree(head) in skb kfree head(). This keeps the free path generic and avoids allocator-specific misclassification for KFENCE objects.

Related Identifiers

CVE-2026-31429

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-31429 · Security Note
• https://git.kernel.org/stable/c/60313768a8edc7094435975587c00c2d7b834083 · Note
• https://git.kernel.org/stable/c/0f42e3f4fe2a58394e37241d02d9ca6ab7b7d516 · Note
• https://git.kernel.org/stable/c/474e00b935db250cac320d10c1d3cf4e44b46721 · Note
• https://git.kernel.org/stable/c/2d64618ea846d8d033477311f805ca487d6a6696 · Note