CVE-2026-43050 Linux内核ATM释放后使用漏洞

/* * Conceptual PoC for CVE-2026-43050 * Demonstrating the race condition between lec_atm_close and lec_atm_send */ #include <pthread.h> #include <stdatomic.h> #include <stdlib.h> #include <stdio.h> // Simulating kernel structures struct socket { int data; }; struct lec_priv { _Atomic(struct socket*) lecd; }; struct lec_priv *priv; // Simulate lec_atm_close - sets lecd to NULL and frees socket void *attacker_thread(void *arg) { printf("[Thread 1] Closing socket and setting priv->lecd to NULL...\n"); struct socket *old_sock = atomic_exchange(&priv->lecd, NULL); if (old_sock) { free(old_sock); // Free the memory } return NULL; } // Simulate lec_atm_send - accesses priv->lecd void *victim_thread(void *arg) { printf("[Thread 2] Attempting to send data...\n"); // Unsafe access pattern (Check-Use) struct socket *sock = atomic_load(&priv->lecd); // Simulate delay to increase race window usleep(100); if (sock != NULL) { printf("[Thread 2] Accessing socket wait queue (CRASH/UAF here if freed)...\n"); // If attacker_thread ran here, sock is a dangling pointer sock->data = 0xDEAD; } return NULL; } int main() { pthread_t t1, t2; priv = malloc(sizeof(struct lec_priv)); priv->lecd = malloc(sizeof(struct socket)); // Create threads to trigger race condition pthread_create(&t1, NULL, attacker_thread, NULL); pthread_create(&t2, NULL, victim_thread, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); free(priv); return 0; }