CVE-2026-43378 Linux内核SMB服务释放后重用漏洞

/* * Conceptual PoC for the Use-After-Free logic in smb2_open() * This demonstrates the incorrect sequence of RCU operations. */ #include <linux/rcupdate.h> struct opinfo { int data; }; struct file { struct opinfo *f_opinfo; }; // Simulating the vulnerable function logic void vulnerable_smb2_open_logic(struct file *fp) { struct opinfo *opinfo; // 1. Enter RCU read-side critical section rcu_read_lock(); // 2. Get pointer under RCU protection opinfo = rcu_dereference(fp->f_opinfo); if (!opinfo) { rcu_read_unlock(); return; } // 3. Exit RCU critical section rcu_read_unlock(); // VULNERABILITY: Accessing opinfo AFTER rcu_read_unlock() // The memory pointed to by opinfo might be freed by another thread here. // This leads to Use-After-Free. pr_info("Accessing opinfo data: %d\n", opinfo->data); }