CVE-2026-43119: Linux内核蓝牙数据竞争漏洞

/* * PoC Concept: Demonstrating the data race scenario * This is a simplified simulation of the kernel race condition. * In the actual kernel, threads run on different workqueues. */ #include <stdio.h> #include <pthread.h> #include <stdatomic.h> // Simulating hdev->req_status volatile int req_status = 0; void* writer_thread(void* arg) { // Simulates __hci_cmd_sync_sk setting status under lock (omitted for race demo) printf("Writer: Setting status to PEND\n"); req_status = 1; // HCI_REQ_PEND return NULL; } void* reader_thread(void* arg) { // Simulates hci_send_cmd_sync reading status without lock int status = req_status; printf("Reader: Read status %d\n", status); if (status == 0) { printf("Reader: Logic error due to stale read!\n"); } return NULL; } int main() { pthread_t t1, t2; // Create concurrent threads to simulate workqueues pthread_create(&t1, NULL, writer_thread, NULL); pthread_create(&t2, NULL, reader_thread, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); return 0; }