CVE-2026-23013: Linux内核octeon_ep_vf驱动IRQ回滚时dev_id不匹配导致use-after-free

// CVE-2026-23013 PoC - Kernel Module to trigger the IRQ dev_id mismatch // This PoC demonstrates the vulnerability in octeon_ep_vf driver's IRQ rollback // Note: This is a conceptual PoC for educational purposes only #include <linux/kernel.h> #include <linux/module.h> #include <linux/pci.h> MODULE_LICENSE("GPL"); MODULE_AUTHOR("Security Researcher"); MODULE_DESCRIPTION("PoC for CVE-2026-23013"); // Simulate the vulnerable code path void simulate_vulnerable_irq_request(struct device *dev, int num_vectors) { struct octep_vf_irq *irqs; int i, ret; irqs = kcalloc(num_vectors, sizeof(*irqs), GFP_KERNEL); if (!irqs) return; // Request interrupts - simulating the vulnerable scenario for (i = 0; i < num_vectors; i++) { // VULNERABILITY: Using ioq_vector as dev_id ret = request_irq(irqs[i].vector, handler, 0, "octep_vf", &irqs[i]); if (ret) { // VULNERABILITY: Rollback uses 'oct' instead of &irqs[i] // This causes dev_id mismatch in free_irq() while (i-- > 0) { free_irq(irqs[i].vector, dev); // Wrong dev_id! } goto cleanup; } } // Normal operation continues... cleanup: // Later cleanup might free irqs while handler still registered kfree(irqs); // This creates use-after-free condition } static int __init cve_2026_23013_init(void) { printk(KERN_INFO "CVE-2026-23013 PoC loaded\n"); printk(KERN_INFO "Vulnerability: IRQ dev_id mismatch in octeon_ep_vf rollback\n"); return 0; } static void __exit cve_2026_23013_exit(void) { printk(KERN_INFO "CVE-2026-23013 PoC unloaded\n"); } module_init(cve_2026_23013_init); module_exit(cve_2026_23013_exit); // Trigger conditions: // 1. Load octeon_ep_vf driver on vulnerable kernel // 2. Trigger partial MSI-X interrupt allocation failure // 3. Observe IRQ handler still registered after rollback // 4. Interrupt after driver cleanup triggers use-after-free