PT-2026-27719 · Linux · Linux Kernel
Published
2026-01-01
·
Updated
2026-03-27
·
CVE-2026-23354
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw exists in the Linux kernel's x86/fred component related to speculative safety within the
fred extint() function. The array index nospec() function was not effectively utilized to prevent memory predictions, as the calculated index was stored on the stack, making it vulnerable. The issue stemmed from the incorrect placement of array index nospec() relative to the array access, specifically occurring after irqentry enter() and involving the index variable being placed in %ebp across a function call. The correction involves repositioning array index nospec() to be calculated immediately before the array access and removing the index variable.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel