Junglewise Threat Intelligence

CVE-2026-31781: Linux Kernel Spectre v1 vulnerability in drm_compat_ioctl

CVE-2026-31781 · Severity: medium · CVSS 5.5 · Published 2026-05-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Direct Rendering Manager (DRM) component, which handles graphics hardware. A local attacker could potentially exploit this flaw to cause a system crash or interfere with kernel operations. This issue is related to how the system handles certain legacy 32-bit compatibility requests on 64-bit systems.

Technical details

A Spectre v1 vulnerability exists in drivers/gpu/drm/drm_ioc32.c within the drm_compat_ioctl function. The code takes a user-controlled command index and uses it to dereference a table of function pointers (drm_compat_ioctls) before the bounds check is fully resolved by the CPU's speculative execution unit. This allows for speculative out-of-bounds array access. The fix implements array_index_nospec() to ensure the index is constrained during speculative execution. This affects 64-bit kernels providing compatibility for 32-bit userspace applications.

Affected products

  • Linux Linux Kernel 3.16.63 to 3.17, 4.4.170 to 4.5, 4.9.148 to 4.10, 4.14.91 to 4.15, 4.19.13 to 4.20, 4.20.1 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.134, 6.7 to 6.12.81, 6.13 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6

Timeline

  • 2026-03-24: patched: Initial patch authored by Greg Kroah-Hartman
  • 2026-05-01: disclosed: CVE published by kernel.org
  • 2026-05-11: advisory: NVD enrichment and analysis completed

References

Related threats