CVE-2026-31553 Linux内核KVM指针计算错误漏洞

/* * Conceptual PoC demonstrating the pointer arithmetic error logic. * This is not a functional exploit, but illustrates the bug. */ #include <stdio.h> #include <stdint.h> void buggy_function(uint64_t hva, int offset) { // The buggy logic from the CVE description // (u64 *)hva + offset results in hva + offset * 8 uint64_t *wrong_addr = (uint64_t *)hva + offset; printf("Buggy Address: %p (Expected %p, but calculated with *8)\n", wrong_addr, (void *)(hva + offset)); } void fixed_function(uint64_t hva, int offset) { // The fix: cast to byte pointer (char *) or add byte offset explicitly uint64_t *correct_addr = (uint64_t *)((uint8_t *)hva + offset); printf("Fixed Address: %p\n", correct_addr); } int main() { uint64_t base = 0x1000; int offset = 1; buggy_function(base, offset); fixed_function(base, offset); return 0; }