CVE-2026-23463 Linux内核竞态条件漏洞

/* * PoC Concept for CVE-2026-23463 * Demonstrating the race condition logic in user-space simulation. * Requires a kernel environment or specific driver interaction for real exploit. */ #include <pthread.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> volatile int fq_table[1024]; volatile int pool_available = 0; void* thread_destroy(void *arg) { int idx = 500; printf("[Thread A] Destroying FQ at idx %d\n", idx); // Simulate gen_pool_free (making ID available) pool_available = 1; // RACE WINDOW: fq_table[idx] is not NULL yet usleep(100); // Cleanup happens late fq_table[idx] = NULL; printf("[Thread A] FQ table entry set to NULL\n"); return NULL; } void* thread_create(void *arg) { usleep(50); // Ensure Thread A starts first printf("[Thread B] Trying to allocate new FQ\n"); if (pool_available) { int new_fqid = 500; int idx = new_fqid * 2; printf("[Thread B] Allocated FQID %d, checking idx %d\n", new_fqid, idx); // The Vulnerable Check: WARN_ON(fq_table[fq->idx]) if (fq_table[idx] != 0) { printf("[Thread B] !!! WARN_ON TRIGGERED !!! Race condition detected.\n"); } else { fq_table[idx] = 1; printf("[Thread B] FQ allocated successfully.\n"); } } return NULL; } int main() { fq_table[1000] = 1; // Init dummy entry pthread_t t1, t2; pthread_create(&t1, NULL, thread_destroy, NULL); pthread_create(&t2, NULL, thread_create, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); return 0; }