CVE-2026-43325: Linux内核iwlwifi驱动拒绝服务漏洞

/* * Conceptual PoC for CVE-2026-43325 * This snippet demonstrates the vulnerable logic where the command * is sent without strictly verifying the hardware's 6E capability. */ #include <linux/module.h> #include <net/mac80211.h> // Simulated vulnerable function context void iwl_mvm_send_mcc_update_cmd(struct iwl_mvm *mvm) { struct iwl_host_cmd cmd = { .id = MCC_ALLOWED_AP_TYPE_CMD, .len = { sizeof(struct iwl_mcc_update_cmd) }, .data = { &mcc_cmd }, .flags = CMD_WANT_SKB, }; // Vulnerability: The driver checks a firmware capability flag that is // incorrectly set by the firmware on non-6E hardware (e.g., AX201). if (fw_has_capa(&mvm->fw->ucode_capa, IWL_UCODE_TLV_CAPA_MCC_SUPPORT)) { // This command triggers a crash on AX201 firmware despite the capa check int ret = iwl_mvm_send_cmd(mvm, &cmd); if (ret) IWL_ERR(mvm, "Failed to send MCC command\n"); } }