CVE-2026-31781

Analyzed Analyzed - Analysis Complete

Spectre Variant 1 Mitigation in Linux Kernel DRM

Publication date: 2026-05-01

Last updated on: 2026-05-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drm/ioc32: stop speculation on the drm_compat_ioctl path The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling array_index_nospec() on the index to the function pointer list.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-01

Last Modified

2026-05-11

Generated

2026-07-06

AI Q&A

2026-05-01

EPSS Evaluated

2026-07-05

NVD

CVE-2026-31781

EUVD

EUVD-2026-26594

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 4.4.170 (inc) to 4.5 (exc)
linux	linux_kernel	4.20
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 5.11 (inc) to 5.15.203 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.22 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.168 (exc)
linux	linux_kernel	From 4.20.1 (inc) to 5.10.253 (exc)
linux	linux_kernel	From 6.19 (inc) to 6.19.12 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.81 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.134 (exc)
linux	linux_kernel	From 3.16.63 (inc) to 3.17 (exc)
linux	linux_kernel	From 4.14.91 (inc) to 4.15 (exc)
linux	linux_kernel	From 4.19.13 (inc) to 4.20 (exc)
linux	linux_kernel	From 4.9.148 (inc) to 4.10 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's drm compat ioctl path. It involves the handling of a user-controlled pointer that is dereferenced into a table of function pointers, which is a known pattern related to Spectre-type vulnerabilities. The issue was that the index used to access the function pointer table could be speculated upon by the processor, potentially leading to speculative execution attacks. The fix involved using the array_index_nospec() function to prevent speculation on the index, thereby mitigating the vulnerability.

Mitigation Strategies

The vulnerability in the Linux kernel related to the drm_compat_ioctl path has been resolved by applying a fix that stops speculation by using array_index_nospec() on the index to the function pointer list.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Impact Analysis

This vulnerability could allow an attacker to exploit speculative execution to access or manipulate memory in unintended ways by controlling the index used to dereference function pointers. This could potentially lead to information disclosure or other security issues related to speculative execution attacks.

Hi! I’m here to help you understand CVE-2026-31781. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70