CVE-2026-43271 Linux内核md-cluster空指针解引用漏洞

/* * Conceptual PoC for triggering the race condition in md-cluster. * This is a simplified representation of the vulnerable code path. */ #include <linux/module.h> #include <linux/md.h> // Simulating the vulnerable function logic void vulnerable_process_metadata_update(struct mddev *mddev) { struct md_thread *thread; // Vulnerability: Acquiring pointer without checking if it's NULL // race window exists here between recv_daemon start and mddev->thread init thread = rcu_dereference_protected(mddev->thread, lockdep_is_held(&mddev->reconfig_mutex)); // This line causes Kernel Panic if thread is NULL wait_event_interruptible(thread->wqueue, test_bit(THREAD_WAKEUP, &thread->flags)); } // Fix implementation (for reference) void fixed_process_metadata_update(struct mddev *mddev) { struct md_thread *thread; thread = rcu_dereference_protected(mddev->thread, lockdep_is_held(&mddev->reconfig_mutex)); if (!thread) { // Release lock and return early if array is not ready return; } wait_event_interruptible(thread->wqueue, test_bit(THREAD_WAKEUP, &thread->flags)); }