The Linux kernel contains a flaw in the network buffer (skb) free logic. When Kernel‑Fences are enabled, the allocator returns the requested size instead of the slab bucket size, causing the deallocation routine to misclassify the object and free it to the wrong slab cache. This cross‑cache free can corrupt kernel memory or trigger a crash, potentially allowing an attacker to gain control or cause denial of service.

The vulnerability applies to any Linux kernel that uses the skb subsystem with KFENCE enabled. All kernel releases that ship the code unchanged prior to the patch are affected. No specific vendor or distribution list is supplied, so the impact is described in terms of the generic Linux kernel.

The CVSS score is not listed, and the EPSS score is unavailable; however the nature of the flaw—freeing memory to an incorrect cache—indicates a high‑severity risk. The vulnerability is not yet in CISA’s KEV catalog. The most likely attack vector is local manipulation of user‑space code that triggers skb allocation, such as malicious BPF programs or crafted network packets, to exploit the misfree and corrupt kernel memory.