CVE-2025-71285 Linux内核qrtr驱动空指针引用漏洞

/* * PoC / Trigger for CVE-2025-71285 * Vulnerability: Race condition in Linux kernel net: qrtr MHI auto_queue * Impact: NULL pointer dereference, Kernel Panic, Denial of Service * * Analysis: * This vulnerability is triggered during the boot process or driver loading * on vulnerable hardware (e.g., Qcom X1E80100 CRD) when the MHI stack * has 'auto_queue' enabled for the IPCR DL channel. * * Exploitation Logic: * 1. System boots on affected hardware. * 2. MHI controller initializes and enables auto_queue for DL channels. * 3. Data arrives or transfer starts, triggering dl_callback. * 4. If dl_callback runs before qrtr_client_probe() completes initialization, * it accesses a NULL pointer. * * Code Snippet (Conceptual Kernel Trace): * // In vulnerable code: * // mhi_queue() is called by MHI stack immediately. * // dl_callback() fires -> accesses qrtr->ep (which is NULL). * // Result: Kernel Panic. */ // Note: This is a hardware/timing dependent race condition. No specific // user-space exploit code is required; simply booting the vulnerable kernel // on the target hardware can trigger the crash.