CVE-2026-43440 Linux kernel net/mana UAF漏洞

/* * Conceptual Proof of Concept for CVE-2026-43440 * This snippet demonstrates the logic flaw in mana_gd_setup. * Triggering the error path leads to UAF in cleanup. */ #include <linux/module.h> #include <linux/workqueue.h> struct mock_gc { struct workqueue_struct *service_wq; }; // Simulating the vulnerable cleanup function void mana_gd_cleanup(struct mock_gc *gc) { if (gc->service_wq) { destroy_workqueue(gc->service_wq); gc->service_wq = NULL; } } // Simulating the vulnerable setup function int mana_gd_setup(struct mock_gc *gc) { gc->service_wq = alloc_workqueue("mana_service", 0, 0); if (!gc->service_wq) return -ENOMEM; // Simulate a setup error occurring after allocation // VULNERABILITY: The code destroys the queue but fails to set gc->service_wq to NULL destroy_workqueue(gc->service_wq); return -EINVAL; // Return error status } // Trigger logic int trigger_vulnerability(void) { struct mock_gc *gc = kzalloc(sizeof(*gc), GFP_KERNEL); if (!gc) return -ENOMEM; // Step 1: Call setup, which fails and frees the workqueue if (mana_gd_setup(gc) != 0) { printk(KERN_INFO "Setup failed, workqueue destroyed but pointer not NULLed.\n"); } // Step 2: Call cleanup // Since gc->service_wq is not NULL, it attempts to destroy the already freed queue -> UAF mana_gd_cleanup(gc); kfree(gc); return 0; }