Linux kernel lib/buildid NULL Pointer Dereference

This repository is a minimal proof-of-concept for a claimed stack buffer overflow in a simulated 5G gNodeB NAS parser, labeled CVE-2026-23002. The repository contains four files: a LICENSE, a README describing the issue and usage, a C source file (gnb_nas_sim.c), and a helper shell script (gnb_nas_sim.sh) to compile and run the demo. The core exploit logic is entirely in gnb_nas_sim.c. The function process_registration_request() allocates a fixed 128-byte stack buffer (ie_buffer), parses a 16-bit Information Element length from the first two bytes of an attacker-controlled message, and copies ie_length bytes from the message into the stack buffer using memcpy without validating that ie_length fits within MAX_IE_SIZE. The main() function constructs a malicious NAS-like message with IE length 256 (0x0100), then attempts to fill 254 bytes of attacker-controlled data and pass the message to the vulnerable parser, demonstrating the overflow condition. Capabilities: the code demonstrates stack memory corruption via oversized length-controlled copy. Its practical result is a local crash/segmentation fault in the simulation. It does not include shellcode, ROP, reverse shell, persistence, or post-exploitation logic. Therefore it is best classified as a POC rather than an operational or weaponized exploit. Attack surface: conceptually, the vulnerability described is a remote network attack against a gNodeB receiving crafted NAS Registration Request data. However, this repository does not implement any radio, SCTP, NGAP, or IP-based delivery path; it only simulates the vulnerable parsing routine locally in C. The shell script simply compiles the binary with weakened protections (-fno-stack-protector and -z execstack) and runs it. Notable caveat: the repository appears to be a synthetic demonstration rather than a real exploit against an identifiable vendor product. No actual network endpoints, IPs, domains, sockets, or protocol handlers are present in the exploit code.