Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
In the Linux kernel, the following vulnerability has been resolved: net: skb: fix cross-cache free of KFENCE-allocated skb head SKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2 value (e.g. 704 on x86_64) to avoid collisions with generic kmalloc bucket sizes. This ensures that skb_kfree_head() can reliably use skb_end_offset to distinguish skb heads allocated from skb_small_head_cache vs. generic kmalloc caches. However, when KFENCE is enabled, kfence_ksize() returns the exact requested allocation size instead of the slab bucket size. If a caller (e.g. bpf_test_init) allocates skb head data via kzalloc() and the requested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then slab_build_skb() -> ksize() returns that exact value. After subtracting skb_shared_info overhead, skb_end_offset ends up matching SKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free the object to skb_small_head_cache instead of back to the original kmalloc cache, resulting in a slab cross-cache free: kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected skbuff_small_head but got kmalloc-1k Fix this by always calling kfree(head) in skb_kfree_head(). This keeps the free path generic and avoids allocator-specific misclassification for KFENCE objects.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-04-20 | 2 | Disclosure1Patch1 |
| 2026-04-22 | 2 | General1Patch1 |
| 2026-04-24 | 1 | PoC1 |
https://github.com/bluedragonsecurity/CVE-2026-31429-POC POC for CVE-2026-31429 (Linux Kernel >= 6.3 < 6.12.82 Slab Cross-Cache Confusion) - vulnerability discovered by Antonius - w1sdom - http://bluedragonsec.com
Post summary
A proof‑of‑concept demonstrating the Slab Cross‑Cache Confusion flaw in Linux kernels 6.3 through 6.12.82 is publicly available on GitHub.
🐧 Kernel edge-case = where bugs breed. CVE-2026-31429 fixes a KFENCE slab mis-ID in skb_kfree_head: misclassify one pointer, and suddenly your networking’s “free” is on the wrong owner. https://windowsforum.com/threads/cve-2026-31429-fix-linux-skb-head-misclassified-with-kfence.414685/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #LinuxKernelSecurity #NetworkingSkb #Kfence #Cve202631429 https://t.co/oGPshfKYo9
Post summary
The tweet announces a fix for CVE-2026-31429, detailing a KFENCE slab misidentification in the Linux kernel’s networking stack, and links to a forum thread discussing the patch.
🪟 CVE-2026-31429 is the classic “small networking bug, big security mess.” Linux tried to be clever about freeing skb memory—KFENCE proves ‘heuristics’ aren’t trust. kfree it. https://windowsforum.com/threads/cve-2026-31429-kernel-skb-head-kfence-wrong-cache-free-fix-uses-kfree.414684/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #LinuxKernelSecurity #Kfence #SkbMemoryManagement #Cve202631429 https://t.co/xLuUDvTmac
Post summary
The tweet discusses CVE‑2026‑31429 as a networking memory bug involving KFENCE, but provides no PoC, exploit, or patch details—all it offers is a commentary on the technical nature of the flaw.
CVE-2026-31429 Linux Kernel SKB Head Cross-Cache Free Vulnerability with KFENCE https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-31429 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The post announces CVE-2026-31429, a Linux kernel vulnerability labeled as a SKB head cross-cache free issue, and provides links to vulnerability details and notifications.
CVE-2026-31429 In the Linux kernel, the following vulnerability has been resolved: net: skb: fix cross-cache free of KFENCE-allocated skb head SKB_SMALL_HEAD_CACHE_SIZE is intenti… https://www.cve.org/CVERecord?id=CVE-2026-31429
Post summary
The entry states that CVE-2026-31429 has been fixed in the Linux kernel with a patch addressing a cross‑cache free issue in skb.
8 of 8 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | linux | linux_kernel | - | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |
| OS | linux | linux_kernel | 7.0 | - | - |