Executive brief
A vulnerability in the Linux kernel's LoongArch architecture could allow a local attacker to bypass security boundaries using speculative execution techniques. This issue affects how the system handles requests from user applications to the core operating system. If exploited, it could potentially allow an attacker to access sensitive information that should be protected by the kernel.
Technical details
A vulnerability exists in the LoongArch architecture implementation within the Linux kernel where the syscall dispatch table lacks proper bounds checking for speculative execution. The syscall number is directly controlled by userspace, and without an 'array_index_nospec()' boundary, the CPU may speculatively execute code past the end of the syscall function pointer table. This is a variant of the Spectre vulnerability that could be used to leak kernel memory via side-channel analysis. The fix involves implementing 'array_index_nospec' in 'arch/loongarch/kernel/syscall.c' to sanitize the syscall index before it is used to reference the 'sys_call_table'.
Affected products
- Linux Linux Kernel LoongArch architecture
Timeline
- 2026-05-27: disclosed
- 2026-05-27: advisory
References
- https://git.kernel.org/stable/c/07040904ad217545be096d4280ed33c02f6a3750
- https://git.kernel.org/stable/c/0c965d2784fbbd7f8e3b96d875c9cfdf7c00da3d
- https://git.kernel.org/stable/c/108f2cd13577a410c0ad6ea00708596d9d0dfc90
- https://git.kernel.org/stable/c/85cbf7fb568af5358aae61925c4e66b8f5e1439d
- https://git.kernel.org/stable/c/bc84a109c2082dd0c4b38e8d923c046b41977533