CVE-2026-23422 Linux内核dpaa2-switch中断风暴漏洞

/* * PoC Concept for CVE-2026-23422 * This code demonstrates the vulnerable logic in the IRQ handler. * Triggering this requires sending a frame that results in an out-of-bounds if_id. */ #include <stdio.h> // Simulated hardware register volatile int interrupt_status = 1; // Vulnerable function logic representation void dpaa2_switch_irq_handler_vulnerable(int if_id) { int MAX_IF_ID = 10; // Check introduced in commit 31a7a0bbeb00 if (if_id < 0 || if_id >= MAX_IF_ID) { printf("[VULNERABLE] Out-of-bounds if_id detected: %d\n", if_id); // BUG: Interrupt status is NOT cleared here return; } // Normal processing... printf("Processing if_id: %d\n", if_id); // Clear interrupt status (only reached in normal path) interrupt_status = 0; } int main() { printf("Simulating IRQ with bad if_id...\n"); // Simulate interrupt storm loop int count = 0; while(interrupt_status && count < 10) { dpaa2_switch_irq_handler_vulnerable(999); // Out of bounds ID count++; } if (count >= 10) { printf("Result: Interrupt Storm detected! Status not cleared.\n"); } return 0; }