Riskcovery

CVE-2026-31781

drm/ioc32: stop speculation on the drm_compat_ioctl path

State
Published
Severity
Not scored
Published
May 1, 2026
Updated
May 23, 2026
Reserved
Mar 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/ioc32: stop speculation on the drm_compat_ioctl path

The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling array_index_nospec() on the index to the function pointer list.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 505b5240329b922f21f91d5b5d1e535c805eca6d to before 46a60ee8956ef1975f00455f614761c7ecedc09dAffected
  • 505b5240329b922f21f91d5b5d1e535c805eca6d to before 5bb398991f378ef74d90b14a6ea8b61ff96cc03aAffected
  • 505b5240329b922f21f91d5b5d1e535c805eca6d to before d59c5d8539662d95887b4564f3f72ad38076a2d5Affected
  • 505b5240329b922f21f91d5b5d1e535c805eca6d to before 489f2ef2b908898d01df697dc4fe1476674be640Affected
  • 505b5240329b922f21f91d5b5d1e535c805eca6d to before 4a41c2b18fc05d30b718d2602cac339eae710b34Affected
  • 505b5240329b922f21f91d5b5d1e535c805eca6d to before f0e441be08a2eab10b2d06fccfa267ee599dd6b3Affected
  • 505b5240329b922f21f91d5b5d1e535c805eca6d to before 27ef84bba9b9d7b03418c60fbc6069ea0e87b13cAffected
  • 505b5240329b922f21f91d5b5d1e535c805eca6d to before f8995c2df519f382525ca4bc90553ad2ec611067Affected
  • abc60edcfc87771ff244763d4d19c67766f5dd0fAffected
  • a2a840d6dcae960c2dfdf3fcb1b759e1b7d90663Affected
  • 00279b505289f7529d9be2e78915d0483ffbd314Affected
  • d04e6ea0cec9e7d6cba806508f657d2d0dc6cacfAffected
  • 7f3ebea19795eb38438cd3709fabf2afd53cf447Affected
  • 3.16.63 to before 3.17Affected
  • 4.4.170 to before 4.5Affected
  • 4.9.148 to before 4.10Affected
  • 4.14.91 to before 4.15Affected
  • 4.19.13 to before 4.20Affected
LinuxLinux
  • 4.20Affected
  • before 4.20Not affected
  • 5.10.253 through 5.10.*Not affected
  • 5.15.203 through 5.15.*Not affected
  • 6.1.168 through 6.1.*Not affected
  • 6.6.134 through 6.6.*Not affected
  • 6.12.81 through 6.12.*Not affected
  • 6.18.22 through 6.18.*Not affected
  • 6.19.12 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.