CVE-2026-31429

In the Linux kernel, the following vulnerability has been resolved:

net: skb: fix cross-cache free of KFENCE-allocated skb head

SKB_SMALL_HEAD_CACHE_SIZE is intentionally set to a non-power-of-2

value (e.g. 704 on x86_64) to avoid collisions with generic kmalloc

bucket sizes. This ensures that skb_kfree_head() can reliably use

skb_end_offset to distinguish skb heads allocated from

skb_small_head_cache vs. generic kmalloc caches.

However, when KFENCE is enabled, kfence_ksize() returns the exact

requested allocation size instead of the slab bucket size. If a caller

(e.g. bpf_test_init) allocates skb head data via kzalloc() and the

requested size happens to equal SKB_SMALL_HEAD_CACHE_SIZE, then

slab_build_skb() -> ksize() returns that exact value. After subtracting

skb_shared_info overhead, skb_end_offset ends up matching

SKB_SMALL_HEAD_HEADROOM, causing skb_kfree_head() to incorrectly free

the object to skb_small_head_cache instead of back to the original

kmalloc cache, resulting in a slab cross-cache free:

kmem_cache_free(skbuff_small_head): Wrong slab cache. Expected

skbuff_small_head but got kmalloc-1k

Fix this by always calling kfree(head) in skb_kfree_head(). This keeps

the free path generic and avoids allocator-specific misclassification

for KFENCE objects.