CVE-2026-31736 Linux内核mtk_ppe空指针解引用漏洞

/* * PoC Concept: Demonstration of the NULL pointer dereference logic * This snippet illustrates the vulnerable logic in mtk_ppe.c. * Exploitation requires a specific kernel configuration where gmac0 is disabled. */ #include <linux/netdevice.h> // Simplified structure representation struct mtk_eth { struct net_device *netdev[2]; // netdev[0] is NULL when gmac0 is disabled }; void vulnerable_check(struct mtk_eth *eth, struct net_device *ingress_dev) { // Vulnerable logic: Directly accesses netdev[0] without checking if it is NULL if (eth->netdev[0]->netdev_ops == ingress_dev->netdev_ops) { // Do something } } void fixed_check(struct mtk_eth *eth, struct net_device *ingress_dev) { // Fixed logic: Check if netdev[0] is valid first int i; for (i = 0; i < 2; i++) { if (eth->netdev[i] && eth->netdev[i]->netdev_ops == ingress_dev->netdev_ops) { // Do something break; } } }