{"id":"CVE-2026-31781","title":"drm/ioc32: stop speculation on the drm_compat_ioctl path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ioc32: stop speculation on the drm_compat_ioctl path\n\nThe drm compat ioctl path takes a user controlled pointer, and then\ndereferences it into a table of function p…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 46a60ee8956ef1975f00455f614761c7ecedc09d","Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 5bb398991f378ef74d90b14a6ea8b61ff96cc03a","Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < d59c5d8539662d95887b4564f3f72ad38076a2d5","Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 489f2ef2b908898d01df697dc4fe1476674be640","Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 4a41c2b18fc05d30b718d2602cac339eae710b34","Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < f0e441be08a2eab10b2d06fccfa267ee599dd6b3","Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 27ef84bba9b9d7b03418c60fbc6069ea0e87b13c","Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < f8995c2df519f382525ca4bc90553ad2ec611067","Linux abc60edcfc87771ff244763d4d19c67766f5dd0f","Linux a2a840d6dcae960c2dfdf3fcb1b759e1b7d90663","Linux 00279b505289f7529d9be2e78915d0483ffbd314","Linux d04e6ea0cec9e7d6cba806508f657d2d0dc6cacf","Linux 7f3ebea19795eb38438cd3709fabf2afd53cf447","Linux >= 3.16.63 < 3.17","Linux >= 4.4.170 < 4.5","Linux >= 4.9.148 < 4.10","Linux >= 4.14.91 < 4.15","Linux >= 4.19.13 < 4.20","Linux 4.20"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T15:25:30.387022Z"},"published":"2026-05-01","updated":"2026-11-06","sourceUpdated":"2026-11-06T15:32:25.445Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31781","references":[{"url":"https://git.kernel.org/stable/c/46a60ee8956ef1975f00455f614761c7ecedc09d"},{"url":"https://git.kernel.org/stable/c/5bb398991f378ef74d90b14a6ea8b61ff96cc03a"},{"url":"https://git.kernel.org/stable/c/d59c5d8539662d95887b4564f3f72ad38076a2d5"},{"url":"https://git.kernel.org/stable/c/489f2ef2b908898d01df697dc4fe1476674be640"},{"url":"https://git.kernel.org/stable/c/4a41c2b18fc05d30b718d2602cac339eae710b34"},{"url":"https://git.kernel.org/stable/c/f0e441be08a2eab10b2d06fccfa267ee599dd6b3"},{"url":"https://git.kernel.org/stable/c/27ef84bba9b9d7b03418c60fbc6069ea0e87b13c"},{"url":"https://git.kernel.org/stable/c/f8995c2df519f382525ca4bc90553ad2ec611067"}],"tags":["cve.org"],"epss":0.00123,"epssPercentile":0.02044,"ingestedAt":"2026-11-06T15:54:04.039Z","slug":"CVE-2026-31781","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndrm/ioc32: stop speculation on the drm_compat_ioctl path\n\nThe drm compat ioctl path takes a user controlled pointer, and then\ndereferences it into a table of function pointers, the signature method\nof spectre problems.  Fix this up by calling array_index_nospec() on the\nindex to the function pointer list.\n\n## Affected\n\n- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 46a60ee8956ef1975f00455f614761c7ecedc09d`\n- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 5bb398991f378ef74d90b14a6ea8b61ff96cc03a`\n- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < d59c5d8539662d95887b4564f3f72ad38076a2d5`\n- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 489f2ef2b908898d01df697dc4fe1476674be640`\n- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 4a41c2b18fc05d30b718d2602cac339eae710b34`\n- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < f0e441be08a2eab10b2d06fccfa267ee599dd6b3`\n- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 27ef84bba9b9d7b03418c60fbc6069ea0e87b13c`\n- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < f8995c2df519f382525ca4bc90553ad2ec611067`\n- `Linux abc60edcfc87771ff244763d4d19c67766f5dd0f`\n- `Linux a2a840d6dcae960c2dfdf3fcb1b759e1b7d90663`\n- `Linux 00279b505289f7529d9be2e78915d0483ffbd314`\n- `Linux d04e6ea0cec9e7d6cba806508f657d2d0dc6cacf`\n- `Linux 7f3ebea19795eb38438cd3709fabf2afd53cf447`\n- `Linux >= 3.16.63 < 3.17`\n- `Linux >= 4.4.170 < 4.5`\n- `Linux >= 4.9.148 < 4.10`\n- `Linux >= 4.14.91 < 4.15`\n- `Linux >= 4.19.13 < 4.20`\n- `Linux 4.20`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}