CVE-2026-43141 Linux内核ntb_hw_switchtec移位越界漏洞

/* * PoC for CVE-2026-43141 * This code simulates the condition that triggers the shift-out-of-bounds * vulnerability in the Linux kernel's ntb_hw_switchtec driver. * * Vulnerability context: * The kernel calls rounddown_pow_of_two(stdev->nr_direct_mw). * If nr_direct_mw is 0, undefined behavior occurs. */ #include <stdio.h> #include <stdint.h> // Simulate the specific kernel macro behavior for rounddown_pow_of_two #define roundup_pow_of_two(n) ( \ __builtin_constant_p(n) ? ( \ (n == 1) ? 1 : \ (1UL << (ilog2((n) - 1) + 1)) \ ) : \ __roundup_pow_of_two(n) \ ) // Simplified logic for demonstration of the fault unsigned long faulty_rounddown(unsigned long n) { // In the kernel, logic similar to (1UL << (fls(n) - 1)) is used // If n is 0, fls(0) is 0, resulting in 1 << -1 which is undefined. if (n == 0) { printf("[!] Triggering undefined behavior with input: 0\n"); // This line attempts the problematic operation return 1UL << (__builtin_clzl(n) - 1); } return 1UL << (31 - __builtin_clzl(n)); } int main() { printf("[*] CVE-2026-43141 PoC Simulation\n"); printf("[*] Simulating MW LUT count = 0\n"); // Trigger the vulnerable path faulty_rounddown(0); return 0; }