CVE-2026-31429: Linux Kernel Privilege Escalation Bug

CVE-2026-31429 Overview

CVE-2026-31429 is a memory management vulnerability in the Linux kernel's network subsystem affecting the socket buffer (SKB) handling when KFENCE (Kernel Fence-post Memory Checker) is enabled. The vulnerability occurs in the skb_kfree_head() function, which incorrectly frees KFENCE-allocated objects to the wrong slab cache, leading to a cross-cache free condition.

The issue stems from how SKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2 value (704 bytes on x86_64) to differentiate between SKB heads allocated from skb_small_head_cache versus generic kmalloc caches. However, when KFENCE is active, kfence_ksize() returns the exact requested allocation size rather than the slab bucket size, causing misclassification and improper memory deallocation.

Critical Impact

This slab cross-cache free vulnerability can lead to kernel memory corruption, potentially enabling privilege escalation or denial of service through memory allocator confusion.

Affected Products

• Linux Kernel (multiple versions with KFENCE enabled)
• Systems running kernels with BPF test functionality (bpf_test_init)
• Linux distributions with KFENCE memory debugging enabled

Discovery Timeline

• 2026-04-20 - CVE CVE-2026-31429 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31429

Vulnerability Analysis

The vulnerability exists in the Linux kernel's SKB (socket buffer) memory management subsystem. The kernel maintains a specialized cache called skb_small_head_cache for small SKB head allocations, using SKB_SMALL_HEAD_CACHE_SIZE as a distinguishing marker. This size is deliberately non-power-of-2 to avoid overlap with standard kmalloc bucket sizes.

The skb_kfree_head() function uses skb_end_offset to determine which cache an SKB head was allocated from. Under normal operation, ksize() returns the actual slab bucket size, allowing correct cache identification. However, KFENCE's kfence_ksize() implementation returns the exact requested allocation size instead.

When a caller such as bpf_test_init allocates SKB head data via kzalloc() with a size matching SKB_SMALL_HEAD_CACHE_SIZE, the subsequent slab_build_skb() → ksize() call returns this exact value. After subtracting skb_shared_info overhead, skb_end_offset incorrectly matches SKB_SMALL_HEAD_HEADROOM, causing the free operation to target the wrong cache.

Root Cause

The root cause is an inconsistency between allocation source identification and the actual memory allocator behavior when KFENCE is enabled. The kfence_ksize() function returns precise allocation sizes for debugging purposes, which breaks the size-based heuristic used by skb_kfree_head() to determine the correct deallocation cache.

This results in the kernel error message:

kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected skbuff_small_head but got kmalloc-1k

Attack Vector

The vulnerability can be triggered locally by any process capable of invoking BPF test functions or similar kernel interfaces that allocate SKB head data through generic kmalloc with sizes matching SKB_SMALL_HEAD_CACHE_SIZE. While direct exploitation requires local access and elevated privileges to invoke BPF operations, the cross-cache free condition could potentially be leveraged for:

1. Kernel Memory Corruption: Freeing objects to the wrong cache corrupts slab allocator metadata
2. Use-After-Free Scenarios: Objects may be reallocated from an unexpected cache, leading to type confusion
3. Privilege Escalation: Through careful heap manipulation, an attacker might achieve arbitrary kernel memory writes

The fix modifies skb_kfree_head() to always call kfree(head) directly, eliminating the allocator-specific classification logic that caused KFENCE misidentification.

Detection Methods for CVE-2026-31429

Indicators of Compromise

• Kernel log messages containing kmem_cache_free(skbuff_small_head): Wrong slab cache
• Unexpected kernel panics or oops in network-related code paths
• KFENCE reports showing cross-cache free violations in the SKB subsystem
• System instability when BPF test operations are performed

Detection Strategies

• Monitor kernel logs (dmesg) for slab cache mismatch warnings related to skbuff_small_head
• Enable KFENCE debugging to detect cross-cache free attempts during testing
• Deploy kernel tracing (ftrace/eBPF) on skb_kfree_head() and kmem_cache_free() functions
• Use kernel memory debugging tools like KASAN to detect memory corruption symptoms

Monitoring Recommendations

• Configure syslog alerts for kernel slab allocator warnings
• Implement automated kernel log analysis for memory subsystem anomalies
• Monitor BPF-related system calls on sensitive systems
• Review audit logs for processes invoking BPF test functionality

How to Mitigate CVE-2026-31429

Immediate Actions Required

• Update to a patched Linux kernel version containing the fix
• On systems where immediate patching is not possible, consider disabling KFENCE if memory debugging is not required
• Restrict access to BPF test interfaces to trusted administrators only
• Monitor kernel logs for any signs of exploitation attempts

Patch Information

The fix has been committed to the stable Linux kernel tree. The patch modifies skb_kfree_head() to always use kfree(head) for deallocation, avoiding the allocator-specific cache classification that caused the KFENCE mismatch.

Available patches:

• Kernel Git Commit 0f42e3f
• Kernel Git Commit 2d64618
• Kernel Git Commit 474e00b
• Kernel Git Commit 60313768

Workarounds

• Disable KFENCE by setting kfence.sample_interval=0 on the kernel command line if memory debugging is not essential
• Restrict BPF capabilities by limiting CAP_BPF and CAP_SYS_ADMIN to essential users only
• Apply kernel hardening configurations to limit exposure to memory corruption vulnerabilities
• Consider using SELinux/AppArmor policies to restrict access to BPF-related interfaces

# Disable KFENCE at boot time (temporary workaround)
# Add to kernel command line in bootloader configuration:
kfence.sample_interval=0

# Verify KFENCE status after boot
cat /sys/module/kfence/parameters/sample_interval