LoongArch Kernel Spectre Bypass in Syscall Dispatch

Publication date: 2026-05-27

Last updated on: 2026-06-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Add spectre boundry for syscall dispatch table The LoongArch syscall number is directly controlled by userspace, but does not have a array_index_nospec() boundry to prevent access past the syscall function pointer tables.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-19

Generated

2026-07-06

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45993

EUVD

EUVD-2026-32289

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.7 (inc) to 6.12.86 (exc)
linux	linux_kernel	From 5.19 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.27 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's LoongArch architecture where the syscall number is directly controlled by userspace. The issue is that there is no array_index_nospec() boundary check to prevent access beyond the syscall function pointer tables. This lack of boundary checking can lead to potential out-of-bounds access in the syscall dispatch table.

Impact Analysis

Because the syscall number is controlled by userspace without proper boundary checks, an attacker could potentially exploit this to access or execute unintended syscall function pointers. This could lead to unauthorized code execution or system instability.

Hi! I’m here to help you understand CVE-2026-45993. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70