CVE-2026-31781

Vulnerability

The Linux kernel's DRM subsystem contains a speculation vulnerability in the drm_compat_ioctl function. This function takes a user-controlled index and uses it to dereference a table of function pointers. Without proper bounds checking, speculative execution can access out-of-bounds memory, leaking sensitive data. This is a classic Spectre v1 (bounds check bypass) pattern [1].

Exploitation

An attacker must have local access to a DRM device (e.g., /dev/dri/card0) and be able to issue DRM ioctl calls. No special privileges beyond a local user account are required. The attacker can train the branch predictor to speculatively execute with an attacker-chosen index, causing the CPU to speculatively read kernel memory at an arbitrary offset. This speculative read can be observed via a cache side-channel, allowing the attacker to infer the contents of kernel memory.

Impact

Successful exploitation could allow an unprivileged local attacker to read arbitrary kernel memory, potentially leaking sensitive information such as cryptographic keys, passwords, or other secrets. The CVSS v3 score is 5.5 (Medium), reflecting the requirement for local access and the high confidentiality impact.

Mitigation

The fix adds a call to array_index_nospec() before indexing into the function pointer table, preventing speculative out-of-bounds access. The patch has been applied to the mainline kernel and backported to stable branches [1]. Users should update to a patched kernel version to mitigate this vulnerability.