CVE-2026-31429: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31429 is a memory management vulnerability in the Linux kernel's socket buffer (SKB) handling code, specifically a slab cross-cache free error triggered when KFENCE (Kernel Electric Fence) is enabled. When a caller allocates SKB head data via kzalloc() with a size equal to SKB_SMALL_HEAD_CACHE_SIZE, the kernel's skb_kfree_head() function incorrectly frees the object to skb_small_head_cache instead of the original kmalloc cache, causing slab cache corruption. Affected Linux kernel versions include 6.3 through 6.6.136, 6.7 through 6.12.82, 6.13 through 6.18.23, 6.19 through 6.19.13, and 7.0 release candidates. It was published on April 20, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified under CWE-763 (Release of Invalid Pointer or Reference) and CWE-401 (Missing Release of Memory after Effective Lifetime). The issue arises because SKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2 value (e.g., 704 bytes on x86_64) to avoid collisions with generic kmalloc bucket sizes, allowing skb_kfree_head() to use skb_end_offset to distinguish allocation origins. However, when KFENCE is enabled, kfence_ksize() returns the exact requested allocation size rather than the slab bucket size; if a caller such as bpf_test_init allocates via kzalloc() with a size matching SKB_SMALL_HEAD_CACHE_SIZE, the resulting skb_end_offset incorrectly matches SKB_SMALL_HEAD_HEADROOM, causing a cross-cache free (kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected skbuff_small_head but got kmalloc-1k). The fix replaces the conditional free logic in skb_kfree_head() with an unconditional kfree(head) call to avoid allocator-specific misclassification (GitHub Advisory). A public PoC (written in C) is available that triggers the vulnerable code path via the BPF_PROG_TEST_RUN syscall (PoC GitHub).

Successful exploitation causes a kernel panic due to slab cache corruption, resulting in a denial of service (system crash). The impact is limited to availability — there is no confidentiality or integrity impact. A local attacker with low privileges can trigger the bug through specific BPF-related memory allocation patterns, making it relevant in multi-tenant or container environments where unprivileged BPF access is permitted (GitHub Advisory, Red Hat).

A proof-of-concept exploit (cve-2026-31429-poc-only.c) is publicly available on GitHub, demonstrating the kernel warn_free_bad_obj warning via BPF_PROG_TEST_RUN, but it does not achieve privilege escalation or remote code execution (PoC GitHub). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.018% (3rd percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection is available via Nessus plugin 307606 (Tenable).

1. Prerequisite check: Confirm the target Linux system is running a vulnerable kernel version (6.3–6.6.135, 6.7–6.12.81, 6.13–6.18.22, or 6.19–6.19.12) with KFENCE enabled (cat /sys/kernel/debug/kfence/stats or check CONFIG_KFENCE=y in kernel config).
2. Compile the PoC: Download cve-2026-31429-poc-only.c from the public repository and compile it: gcc -o poc cve-2026-31429-poc-only.c.
3. Trigger the vulnerable path: Execute the compiled PoC as a low-privileged local user. The program invokes the BPF_PROG_TEST_RUN syscall, which internally calls bpf_test_init, allocating SKB head data via kzalloc() with a size equal to SKB_SMALL_HEAD_CACHE_SIZE.
4. Observe kernel corruption: When KFENCE intercepts the allocation and returns the exact requested size, skb_kfree_head() misidentifies the cache and frees the object to skb_small_head_cache instead of kmalloc-1k, triggering a kernel WARN (warn_free_bad_obj) visible in dmesg.
5. Result: The kernel logs a slab cache mismatch warning and may panic depending on kernel configuration, causing a denial of service (PoC GitHub).

• Logs: Kernel messages in dmesg or /var/log/kern.log containing kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected skbuff_small_head but got kmalloc-1k or warn_free_bad_obj.
• Logs: Kernel panic or BUG traces referencing skb_kfree_head, slab_build_skb, or kfence_ksize in kernel oops output.
• Process: Unusual execution of BPF-related programs by low-privileged users, particularly processes invoking BPF_PROG_TEST_RUN syscalls observable via strace or eBPF-based audit tools.
• System: Unexpected system reboots or kernel panics on systems with KFENCE enabled (CONFIG_KFENCE=y) running affected kernel versions (PoC GitHub, GitHub Advisory).

Update the Linux kernel to a patched stable version: 6.6.136 or later, 6.12.82 or later, 6.18.23 or later, or 6.19.13 or later. Patches are available in the kernel stable branches via the upstream kernel git repository (kernel patches). As a temporary workaround where upgrading is not immediately possible, disable KFENCE by setting kernel.kfence.enabled=0 (if supported) or by rebuilding the kernel without CONFIG_KFENCE=y, since the vulnerability only manifests when KFENCE is active. Restricting unprivileged access to BPF syscalls (e.g., setting kernel.unprivileged_bpf_disabled=1) can also reduce the attack surface (GitHub Advisory, Red Hat).

Red Hat has acknowledged the vulnerability and published a tracking entry via Bugzilla (Red Hat Bugzilla). The Yocto Project security mailing list also referenced the CVE in the context of embedded Linux security updates (Yocto Security). Community reaction has been limited given the moderate severity and narrow exploitation conditions; no significant media coverage or notable researcher commentary beyond the PoC publication has been observed.