CVE-2025-71075: Linux内核aic94xx驱动设备移除时use-after-free漏洞

// PoC concept for CVE-2025-71075 // Note: This is a conceptual demonstration, actual exploitation requires specific hardware #include <linux/module.h> #include <linux/pci.h> MODULE_LICENSE("GPL"); static int trigger_race_condition(struct pci_dev *dev) { // Trigger device removal while tasklets are pending // This would require specific aic94xx hardware // Step 1: Ensure aic94xx device is present and initialized if (!dev || dev->vendor != PCI_VENDOR_ID_ADAPTEC2) return -ENODEV; // Step 2: Trigger I/O operations to queue tasklets // This increases the likelihood of pending tasklets // Step 3: Immediately trigger device removal // Use hotplug or module unload to trigger asd_pci_remove() // Race condition window: // asd_pci_remove() frees asd_ha while tasklets may still access it return 0; } static int __init poc_init(void) { printk(KERN_INFO "CVE-2025-71075 PoC loaded\n"); return 0; } static void __exit poc_exit(void) { printk(KERN_INFO "CVE-2025-71075 PoC unloaded\n"); } module_init(poc_init); module_exit(poc_exit);