CVE-2026-43432 Linux内核xhci驱动内存泄漏漏洞

/* * Conceptual PoC for CVE-2026-43432 Memory Leak * This snippet demonstrates the vulnerable logic flow. * Triggering this requires specific hardware state or emulation. */ #include <linux/module.h> #include <linux/usb.h> // Mocking the vulnerable structure struct xhci_command { struct completion *cmd_completion; void *in_ctx; }; // Vulnerable function simulation void vulnerable_xhci_disable_slot_simulation() { struct xhci_command *cmd; // Allocation similar to xhci_alloc_command(..., true) cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); if (!cmd) return; cmd->cmd_completion = kmalloc(sizeof(struct completion), GFP_KERNEL); if (!cmd->cmd_completion) { // Error path: Incorrectly freeing only 'cmd' kfree(cmd); // BUG: Leaks cmd_completion return; } // ... operation logic ... // Correct cleanup should be xhci_free_command(cmd) // which would free both cmd and cmd_completion } // Fix simulation void fixed_xhci_disable_slot_simulation() { struct xhci_command *cmd; cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); if (!cmd) return; cmd->cmd_completion = kmalloc(sizeof(struct completion), GFP_KERNEL); if (!cmd->cmd_completion) { // Fix: Use proper cleanup function if (cmd->in_ctx) kfree(cmd->in_ctx); kfree(cmd->cmd_completion); kfree(cmd); return; } }