CVE-2026-23324: Linux内核CAN驱动内存泄漏漏洞

/* * PoC Concept: Vulnerability Demonstration in etas_es58x * This code illustrates the vulnerable logic in the read bulk callback. */ #include <linux/usb.h> // Vulnerable implementation pattern void vulnerable_read_bulk_callback(struct urb *urb) { struct usb_anchor *anchor = get_anchor_from_context(urb); // VULNERABILITY: URB is submitted BEFORE being anchored. // If usb_kill_anchored_urbs() is called here, the URB is leaked. int ret = usb_submit_urb(urb, GFP_ATOMIC); if (ret) { // Handle error } else { // Anchoring happens after submission, creating a race window. usb_anchor_urb(urb, anchor); } } // Fixed implementation pattern void fixed_read_bulk_callback(struct urb *urb) { struct usb_anchor *anchor = get_anchor_from_context(urb); // FIX: Anchor the URB before submitting it. usb_anchor_urb(urb, anchor); int ret = usb_submit_urb(urb, GFP_ATOMIC); if (ret) { // If submission fails, unanchor to prevent leaks usb_unanchor_urb(urb); } }