CVE-2026-43121: Linux内核io_uring竞态条件漏洞

/* * Conceptual PoC for CVE-2026-43121 Race Condition * This code simulates the race between io_zcrx_scrub and refill path. */ #include <pthread.h> #include <stdatomic.h> #include <stdio.h> #include <unistd.h> // Simulating kernel structure struct io_zcrx_queue { atomic_int user_refs; int free_count; int nr_iovs; }; struct io_zcrx_queue q; // Simulating io_zcrx_scrub (CPU1: no lock) void *scrub_thread(void *arg) { // Window opens: atomic_xchg without rq_lock int old = atomic_exchange(&q.user_refs, 0); printf("[Scrub] Exchanged ref %d to 0\n", old); // Simulate pushing to freelist (PUSH #1) q.free_count++; printf("[Scrub] Free count: %d\n", q.free_count); return NULL; } // Simulating io_zcrx_put_niov_uref (CPU0: holds rq_lock) void *refill_thread(void *arg) { // Simulate lock acquisition // Non-atomic check-then-decrement int ref = atomic_load(&q.user_refs); // Race window here usleep(100); if (ref > 0) { atomic_fetch_sub(&q.user_refs, 1); printf("[Refill] Decremented ref.\n"); // Simulate pushing to freelist (PUSH #2: DOUBLE-FREE) q.free_count++; printf("[Refill] Free count: %d (Potential OOB)\n", q.free_count); if (q.free_count > q.nr_iovs) { printf("[!!!] Out-of-bounds write triggered!\n"); } } return NULL; } int main() { atomic_init(&q.user_refs, 1); q.nr_iovs = 1; q.free_count = 0; pthread_t t1, t2; // Trigger race pthread_create(&t1, NULL, refill_thread, NULL); pthread_create(&t2, NULL, scrub_thread, NULL); pthread_join(t1, NULL); pthread_join(t2, NULL); return 0; }