CVE-2026-43149: Linux内核fsl_ucc_hdlc双重释放漏洞

/* * PoC Concept for CVE-2026-43149 * This demonstrates the allocation/deallocation logic error. */ #include <stdlib.h> #include <string.h> struct buffer { char *rx; char *tx; }; void vulnerable_init(struct buffer *priv, size_t size) { // Allocate one contiguous buffer for both RX and TX priv->rx = (char *)malloc(size * 2); priv->tx = priv->rx + size; // Offset for TX } void vulnerable_cleanup(struct buffer *priv) { // Bug: Freeing the RX buffer (which frees the whole block) free(priv->rx); // Bug: Attempting to free TX again (Double Free) free(priv->tx); } int main() { struct buffer priv; vulnerable_init(&priv, 1024); vulnerable_cleanup(&priv); // Triggers double free corruption return 0; }