CVE-2026-31483

Vulnerability

The s390 architecture's syscall dispatch table does not use array_index_nospec() to bound the syscall number, which is directly controlled by userspace. This missing speculation barrier could allow an attacker to speculatively access memory beyond the syscall function pointer tables.

Exploitation

An unprivileged local user can invoke a syscall with a crafted number that, during speculative execution, may bypass bounds checks and read or jump to arbitrary kernel addresses. No special privileges are required beyond the ability to execute syscalls.

Impact

Successful exploitation could lead to information disclosure (reading kernel memory) or potentially control flow hijacking via speculative execution, similar to Spectre variant 1 attacks. The CVSS score of 5.5 reflects a medium severity.

Mitigation

The fix adds array_index_nospec() to the syscall dispatch path. Patches have been applied to the stable kernel trees as seen in commits [1], [2], [3], [4]. Users should update to kernels containing these fixes.