Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash. The issue occurs when the system incorrectly handles memory cleanup for certain network data buffers, particularly when specific debugging features are enabled. This can lead to memory corruption and a subsequent denial of service, impacting system stability and availability.
Technical details
A cross-cache free vulnerability exists in the Linux kernel's networking subsystem (net/core/skbuff.c). The root cause is a misidentification of memory caches in skb_kfree_head() when KFENCE is enabled. Specifically, KFENCE returns exact requested allocation sizes rather than slab bucket sizes; if a requested size matches SKB_SMALL_HEAD_CACHE_SIZE, the kernel incorrectly assumes the object belongs to the skb_small_head_cache instead of the generic kmalloc cache. This results in a 'Wrong slab cache' error and a kernel panic. The vulnerability can be triggered locally, for example via bpf_test_init. Patches have been released across multiple stable kernel branches to unify the free path using kfree().
Affected products
- Linux Linux Kernel 6.3 to 6.6.136, 6.7 to 6.12.82, 6.13 to 6.18.23, 6.19 to 6.19.13, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-20: advisory: Initial disclosure and NVD publication
- 2026-04-06: patched: Mainline patch committed by Jakub Kicinski
References
- https://git.kernel.org/stable/c/0f42e3f4fe2a58394e37241d02d9ca6ab7b7d516
- https://git.kernel.org/stable/c/128b03ccb2582a643983a48a37fda58df80edbde
- https://git.kernel.org/stable/c/2d64618ea846d8d033477311f805ca487d6a6696
- https://git.kernel.org/stable/c/474e00b935db250cac320d10c1d3cf4e44b46721
- https://git.kernel.org/stable/c/60313768a8edc7094435975587c00c2d7b834083