CVE-2026-23256 Linux kernel liquidio驱动setup_nic_devices内存泄漏漏洞

/* * CVE-2026-23256 PoC - Liquidio VF setup_nic_devices Memory Leak * This PoC demonstrates the off-by-one error in cleanup loop * Compile: gcc -o cve_2026_23256_poc cve_2026_23256_poc.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> /* Simulated nic device structure */ struct nic_device { void *data; int id; }; #define MAX_DEVICES 8 /* Vulnerable cleanup function - original buggy version */ void buggy_cleanup(struct nic_device *devices, int i) { printf("[BUGGY] Cleanup loop with while(i--):\n"); printf("[BUGGY] Failed at index: %d\n", i); int count = 0; while (i--) { printf("[BUGGY] Freeing device at index: %d\n", i); if (devices[i].data) { free(devices[i].data); devices[i].data = NULL; count++; } } printf("[BUGGY] Freed %d devices, skipped index %d (LEAK)\n\n", count, i); } /* Fixed cleanup function */ void fixed_cleanup(struct nic_device *devices, int i) { printf("[FIXED] Cleanup loop with for(i--; i>=0; i--):\n"); printf("[FIXED] Failed at index: %d\n", i); int count = 0; for (int j = i; j >= 0; j--) { printf("[FIXED] Freeing device at index: %d\n", j); if (devices[j].data) { free(devices[j].data); devices[j].data = NULL; count++; } } printf("[FIXED] Freed %d devices including failed index %d (NO LEAK)\n\n", count, i); } int main() { struct nic_device devices[MAX_DEVICES]; int fail_index = 3; printf("=== CVE-2026-23256 PoC Demonstration ===\n\n"); /* Simulate device allocation */ for (int i = 0; i < MAX_DEVICES; i++) { devices[i].data = malloc(1024); devices[i].id = i; memset(devices[i].data, 0, 1024); printf("[INIT] Allocated device %d\n", i); } printf("\nSimulating initialization failure at index %d:\n\n", fail_index); /* Demonstrate buggy cleanup */ buggy_cleanup(devices, fail_index); /* Reset devices for fixed version */ for (int i = 0; i < MAX_DEVICES; i++) { if (!devices[i].data) { devices[i].data = malloc(1024); memset(devices[i].data, 0, 1024); } } /* Demonstrate fixed cleanup */ fixed_cleanup(devices, fail_index); printf("\n=== PoC Complete ===\n"); printf("The buggy version leaks device at index %d\n", fail_index); printf("The fixed version properly frees all allocated devices\n"); return 0; }