CVE-2026-43231 Linux内核内存泄露漏洞

/* * Conceptual PoC for Memory Leak in radio-keene driver * This code demonstrates the vulnerable logic flow. * Triggering this in a real environment requires specific hardware or fault injection. */ #include <linux/module.h> #include <linux/usb.h> #include <media/v4l2-ctrls.h> #include <media/v4l2-device.h> static int usb_keene_probe(struct usb_interface *intf, const struct usb_device_id *id) { struct keene_device *radio; int retval; radio = kzalloc(sizeof(struct keene_device), GFP_KERNEL); if (!radio) return -ENOMEM; // Initialize control handler retval = v4l2_ctrl_handler_init(&radio->hdl, 2); if (retval) { goto err_free_mem; } // Add controls v4l2_ctrl_new_std(&radio->hdl, &keene_ctrl_ops, V4L2_CID_AUDIO_MUTE, 0, 1, 1, 1); if (radio->hdl.error) { retval = radio->hdl.error; goto err_free_ctrl; // Vulnerable path might skip this in some versions } radio->v4l2_dev.ctrl_handler = &radio->hdl; // Simulate failure in device registration to trigger error path retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev); if (retval < 0) { goto err_v4l2; // Jump to error path } // ... rest of the probe ... return 0; err_v4l2: // VULNERABILITY: Missing v4l2_ctrl_handler_free(&radio->hdl); // This causes the memory allocated for the handler to leak. v4l2_device_unregister(&radio->v4l2_dev); err_free_ctrl: v4l2_ctrl_handler_free(&radio->hdl); // This is the fix err_free_mem: kfree(radio); return retval; }