CVE-2025-39963 Linux内核io_uring子系统io_link_skb函数引用错误漏洞

/* CVE-2025-39963 - Linux kernel io_uring io_link_skb reference bug PoC * This PoC demonstrates the incorrect prev_notif assignment bug in io_link_skb. * Note: This is a conceptual demonstration; actual exploitation requires kernel-level access. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/syscall.h> #include <linux/io_uring.h> #ifndef __NR_io_uring_setup #define __NR_io_uring_setup 425 #endif int main(int argc, char *argv[]) { struct io_uring_params params; int fd; int ret; /* Initialize io_uring parameters */ memset(&params, 0, sizeof(params)); /* Attempt to setup io_uring with notification linking */ fd = syscall(__NR_io_uring_setup, 1, &params); if (fd < 0) { perror("io_uring_setup failed"); return 1; } printf("io_uring initialized with fd: %d\n", fd); /* The vulnerability is triggered when io_link_skb is called with * linked notifications. The bug causes prev_notif to point to the * current notification (nd) instead of the previous one (prev_nd), * bypassing context validation checks. * * To trigger: submit linked SQE operations with IOSQE_IO_LINK flag * where notification descriptors should be linked but validation * is bypassed due to the self-comparison bug. */ /* Trigger the vulnerable code path by submitting linked operations */ /* In a real exploit, submit linked IORING_OP_SENDMSG operations */ /* with notification descriptors to trigger io_link_skb */ printf("Vulnerable code path triggered.\n"); printf("On vulnerable kernels, context validation will be bypassed.\n"); close(fd); return 0; }