CVE-2026-31594: Linux内核pci-epf-vntb重复释放漏洞

/* * PoC Concept: Triggering the double free via configfs. * This requires a system with the pci-epf-vntb module loaded and configfs mounted. * The vulnerability is triggered by creating a symlink which invokes the * pci_primary_epc_epf_link -> allow_link path followed by a failure condition. */ #include <stdio.h> #include <unistd.h> #include <sys/stat.h> int main() { // Note: Actual exploitation requires specific hardware setup and kernel config. // This code demonstrates the theoretical trigger point mentioned in the stack trace (do_symlinkat). printf("[*] Attempting to trigger CVE-2026-31594\n"); printf("[*] Targeting Linux Kernel pci-epf-vntb double free\n"); // The actual trigger happens via configfs symlink operations: // symlink("target_epc", "/sys/kernel/config/pci_ep/.../function_1/primary"); // If allow_link fails or drop_link is called, the kernel crashes. printf("[!] Exploitation depends on specific PCI endpoint hardware configuration.\n"); printf("[!] Kernel crash occurs in pci_epc_remove_epf due to double free.\n"); return 0; }