CVE-2026-43463 Linux内核rxrpc/afs错误指针检查缺失漏洞

/* * Conceptual PoC for CVE-2026-43463 * This snippet simulates the missing IS_ERR() check logic. * Triggering this requires an environment where AFS is active * and memory allocation can be forced to fail during peer lookup. */ #include <linux/module.h> #include <linux/kernel.h> #include <rxrpc/rxrpc.h> // Simulated vulnerable scenario logic void vulnerable_afs_call(void) { struct rxrpc_peer *peer; // The function rxrpc_kernel_lookup_peer might return an error pointer peer = rxrpc_kernel_lookup_peer(...); // Vulnerability: Only checking for NULL, not IS_ERR(peer) if (peer == NULL) { pr_err("Peer is NULL\n"); return; } // If peer is an error pointer (e.g., -ENOMEM converted to pointer), // accessing it here causes a kernel crash (Oops/Panic). pr_info("Peer looked up: %p\n", peer); } // Note: Actual exploitation requires specific kernel conditions.