CVE-2026-31781
drm/ioc32: stop speculation on the drm_compat_ioctl path
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.17, 4.5, 4.10, 4.15, 4.20
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/ioc32: stop speculation on the drm_compat_ioctl path The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling array_index_nospec() on the index to the function pointer list.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 3.16.63 · fixed in 3.17; From 4.4.170 · fixed in 4.5; From 4.9.148 · fixed in 4.10; From 4.14.91 · fixed in 4.15; From 4.19.13 · fixed in 4.20
- Linux Linux
4.20
References 8
git.kernel.org
- stable/c/46a60ee8956ef1975f00455f614761c7ecedc09d
- stable/c/5bb398991f378ef74d90b14a6ea8b61ff96cc03a
- stable/c/d59c5d8539662d95887b4564f3f72ad38076a2d5
- stable/c/489f2ef2b908898d01df697dc4fe1476674be640
- stable/c/4a41c2b18fc05d30b718d2602cac339eae710b34
- stable/c/f0e441be08a2eab10b2d06fccfa267ee599dd6b3
- stable/c/27ef84bba9b9d7b03418c60fbc6069ea0e87b13c
- stable/c/f8995c2df519f382525ca4bc90553ad2ec611067