CVE-2026-31638 Linux内核rxrpc拒绝服务漏洞

/* * Conceptual PoC for CVE-2026-31638 * This snippet demonstrates the logic that triggers the kernel crash. * It requires a kernel environment with rxrpc enabled. */ #include <linux/module.h> #include <linux/net.h> // Simulated structures to represent the kernel internals struct rxrpc_call; struct rxrpc_channel { struct rxrpc_call *call; }; // Simulate the function that fails to get the call static inline struct rxrpc_call *rxrpc_try_get_call(struct rxrpc_call *call) { // In the vulnerable scenario, this returns NULL because the call is torn down return NULL; } // Simulate the function that puts the call (causes crash if NULL) static inline void rxrpc_put_call(struct rxrpc_call *call) { // Missing NULL check here in the vulnerable code leads to panic if (call == NULL) panic("CVE-2026-31638: NULL pointer dereference in rxrpc_put_call"); } void vulnerable_rxrpc_path(struct rxrpc_channel *chan) { struct rxrpc_call *call; // rxrpc_input_packet_on_conn logic call = rxrpc_try_get_call(chan->call); // Implicit-end error path // VULNERABILITY: The code does not check if 'call' is valid before dropping ref if (!call) { // This path is reached when processing a packet after teardown printk(KERN_INFO "Processing packet on torn down call...\n"); } // The actual vulnerable line in the kernel source: // rxrpc_put_call(call); // <--- Crashes here if call is NULL // To trigger the vulnerability, an attacker sends a packet that forces // this execution flow with chan->call == NULL. }