CVE-2026-23354
Speculative Execution Flaw in Linux Kernel x86 fred_extint
Publication date: 2026-03-25
Last updated on: 2026-04-24
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.9 |
| linux | linux_kernel | From 6.19 (inc) to 6.19.7 (exc) |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.17 (exc) |
| linux | linux_kernel | From 6.9.1 (inc) to 6.12.77 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-129 | The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel relates to the incorrect use of the function array_index_nospec() in the x86/fred component, specifically in the fred_extint() function. The function array_index_nospec() is intended to prevent speculative execution attacks by ensuring that array indices are safe under speculation. However, if the result of array_index_nospec() is spilled to the stack, it becomes vulnerable to memory prediction attacks. In this case, the index variable is stored across a function call, which undermines the protection. The fix involves removing the index variable and repositioning the array_index_nospec() call so that it is calculated immediately before the array access, ensuring proper speculative safety.
How can this vulnerability impact me? :
This vulnerability can potentially allow attackers to exploit speculative execution side channels to read sensitive data from memory that should be protected. Because the speculative safety mechanism is incorrectly applied, it may lead to unauthorized disclosure of information through memory prediction attacks, which can compromise system security and confidentiality.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is resolved by correcting the speculative safety in the fred_extint() function in the Linux kernel. Specifically, the fix involves removing the index variable and repositioning array_index_nospec() so it is calculated immediately before the array access.
To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.