PT-2026-36416 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-11 · CVE-2026-31781

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The drm compat ioctl path accepts a user-controlled pointer and dereferences it into a table of function pointers. This pattern is characteristic of Spectre problems, which are side-channel attacks that exploit speculative execution in processors to leak sensitive data. The issue occurs during the processing of the drm compat ioctl path.

Recommendations Apply the fix by calling the array index nospec() function on the index to the function pointer list.

Fix

Related Identifiers

CVE-2026-31781

ECHO-2C16-47C8-5B2D

Affected Products

Linux Kernel

References · 18

• https://git.kernel.org/stable/c/5bb398991f378ef74d90b14a6ea8b61ff96cc03a · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31781 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-31781 · Vendor Advisory
• https://git.kernel.org/stable/c/489f2ef2b908898d01df697dc4fe1476674be640 · Patch
• https://git.kernel.org/stable/c/f0e441be08a2eab10b2d06fccfa267ee599dd6b3 · Patch
• https://ubuntu.com/security/CVE-2026-31781 · Vendor Advisory
• https://git.kernel.org/stable/c/d59c5d8539662d95887b4564f3f72ad38076a2d5 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31781 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31781 · Vendor Advisory
• https://git.kernel.org/stable/c/27ef84bba9b9d7b03418c60fbc6069ea0e87b13c · Patch
• https://git.kernel.org/stable/c/46a60ee8956ef1975f00455f614761c7ecedc09d · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31781 · Vendor Advisory
• https://git.kernel.org/stable/c/f8995c2df519f382525ca4bc90553ad2ec611067 · Patch
• https://git.kernel.org/stable/c/4a41c2b18fc05d30b718d2602cac339eae710b34 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-31781 · Security Note