CVE-2026-23306 Linux内核pm8001双重释放漏洞

/* * PoC Concept for CVE-2026-23306 * Triggering the double free requires specific hardware or emulation. * This snippet simulates the logic flow leading to the crash. */ #include <linux/module.h> #include <scsi/scsi_host.h> void simulate_vulnerability_flow(struct pm8001_hba_info *pm8001_ha) { struct sas_task *task = kmalloc(sizeof(*task), GFP_KERNEL); // Simulate PHY down or device gone state int device_state = DEVICE_GONE; // Inside pm8001_queue_command logic (vulnerable path) if (device_state == DEVICE_GONE) { task->task_state_flags = SAS_TASK_STATE_DONE; // The driver frees the task here kfree(task); // Returns error instead of 0, triggering the bug return -ENODEV; } } // Caller (sas_ata_qc_issue) logic void caller_logic(int ret, struct sas_task *task) { if (ret == -ENODEV) { // Caller assumes task wasn't handled and tries to free it again // DOUBLE FREE occurs here kfree(task); } }