CVE-2026-31745: Linux内核GPIO重置双重释放漏洞

/* * PoC Simulation for CVE-2026-31745 * Demonstrating the double free logic in the error path. * This is a simulation of the kernel vulnerable code flow. */ #include <stdio.h> #include <stdlib.h> #include <string.h> // Simulating kernel structures struct auxiliary_device { char name[32]; }; // Simulating the release callback void reset_gpio_aux_device_release(struct auxiliary_device *adev) { printf("[Release] Freeing adev at %p\n", (void*)adev); free(adev); } // Simulating auxiliary_device_uninit -> puts device -> triggers release void auxiliary_device_uninit(struct auxiliary_device *adev) { reset_gpio_aux_device_release(adev); } // Simulating __auxiliary_device_add failure int __auxiliary_device_add(struct auxiliary_device *adev) { // Force failure to trigger the error path return -EINVAL; } // The vulnerable function logic void reset_add_gpio_aux_device() { struct auxiliary_device *adev; int ret; // Allocation adev = (struct auxiliary_device *)malloc(sizeof(struct auxiliary_device)); if (!adev) return; strcpy(adev->name, "gpio_reset"); printf("[Init] Allocated adev at %p\n", (void*)adev); // Initialization (implied success for PoC) // Attempt to add device ret = __auxiliary_device_add(adev); if (ret) { printf("[Error] __auxiliary_device_add failed with code %d\n", ret); // VULNERABLE PATH START auxiliary_device_uninit(adev); // This calls kfree(adev) internally printf("[Vuln] Calling kfree(adev) again...\n"); // kfree(adev); // The bug is here, uncommenting causes double free free(adev); // Simulating the second free // VULNERABLE PATH END printf("[Vuln] Double free occurred. Heap corruption likely.\n"); return; } } int main() { reset_add_gpio_aux_device(); return 0; }