CVE-2026-43008 Linux内核qixis-fpga驱动空指针解引用漏洞

/* * Conceptual Proof of Concept for CVE-2026-43008 * This snippet demonstrates the vulnerable logic. * Triggering the actual bug requires specific hardware/failure conditions. */ #include <linux/module.h> #include <linux/platform_device.h> #include <linux/regmap.h> static int vulnerable_probe(struct platform_device *pdev) { struct resource *res; void __iomem *base; struct regmap *map; res = platform_get_resource(pdev, IORESOURCE_MEM, 0); base = devm_ioremap_resource(&pdev->dev, res); if (IS_ERR(base)) return PTR_ERR(base); // Vulnerable call: Returns ERR_PTR on error, not NULL map = devm_regmap_init_mmio(&pdev->dev, base, &qixis_regmap_config); // BUG: The check assumes NULL on failure if (!map) { // In a real failure scenario (e.g. -EINVAL), this block is skipped dev_err(&pdev->dev, "Failed to init regmap\n"); return -ENOMEM; } // If devm_regmap_init_mmio failed, 'map' holds an error address (e.g. 0xffff...) // Accessing it here causes a Kernel Panic/Oops regmap_write(map, 0x0, 0x1); return 0; }