---
id: CVE-2026-31781
title: 'drm/ioc32: stop speculation on the drm_compat_ioctl path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  drm/ioc32: stop speculation on the drm_compat_ioctl path

  The drm compat ioctl path takes a user controlled pointer, and then
  dereferences it into a table of function p…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d <
    46a60ee8956ef1975f00455f614761c7ecedc09d
  - >-
    Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d <
    5bb398991f378ef74d90b14a6ea8b61ff96cc03a
  - >-
    Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d <
    d59c5d8539662d95887b4564f3f72ad38076a2d5
  - >-
    Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d <
    489f2ef2b908898d01df697dc4fe1476674be640
  - >-
    Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d <
    4a41c2b18fc05d30b718d2602cac339eae710b34
  - >-
    Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d <
    f0e441be08a2eab10b2d06fccfa267ee599dd6b3
  - >-
    Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d <
    27ef84bba9b9d7b03418c60fbc6069ea0e87b13c
  - >-
    Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d <
    f8995c2df519f382525ca4bc90553ad2ec611067
  - Linux abc60edcfc87771ff244763d4d19c67766f5dd0f
  - Linux a2a840d6dcae960c2dfdf3fcb1b759e1b7d90663
  - Linux 00279b505289f7529d9be2e78915d0483ffbd314
  - Linux d04e6ea0cec9e7d6cba806508f657d2d0dc6cacf
  - Linux 7f3ebea19795eb38438cd3709fabf2afd53cf447
  - Linux >= 3.16.63 < 3.17
  - Linux >= 4.4.170 < 4.5
  - Linux >= 4.9.148 < 4.10
  - Linux >= 4.14.91 < 4.15
  - Linux >= 4.19.13 < 4.20
  - Linux 4.20
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:25:30.387022Z'
published: '2026-05-01'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:25.445Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31781'
references:
  - url: 'https://git.kernel.org/stable/c/46a60ee8956ef1975f00455f614761c7ecedc09d'
  - url: 'https://git.kernel.org/stable/c/5bb398991f378ef74d90b14a6ea8b61ff96cc03a'
  - url: 'https://git.kernel.org/stable/c/d59c5d8539662d95887b4564f3f72ad38076a2d5'
  - url: 'https://git.kernel.org/stable/c/489f2ef2b908898d01df697dc4fe1476674be640'
  - url: 'https://git.kernel.org/stable/c/4a41c2b18fc05d30b718d2602cac339eae710b34'
  - url: 'https://git.kernel.org/stable/c/f0e441be08a2eab10b2d06fccfa267ee599dd6b3'
  - url: 'https://git.kernel.org/stable/c/27ef84bba9b9d7b03418c60fbc6069ea0e87b13c'
  - url: 'https://git.kernel.org/stable/c/f8995c2df519f382525ca4bc90553ad2ec611067'
tags:
  - cve.org
epss: 0.00123
epssPercentile: 0.02044
ingestedAt: '2026-11-06T15:54:04.039Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

drm/ioc32: stop speculation on the drm_compat_ioctl path

The drm compat ioctl path takes a user controlled pointer, and then
dereferences it into a table of function pointers, the signature method
of spectre problems.  Fix this up by calling array_index_nospec() on the
index to the function pointer list.

## Affected

- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 46a60ee8956ef1975f00455f614761c7ecedc09d`
- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 5bb398991f378ef74d90b14a6ea8b61ff96cc03a`
- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < d59c5d8539662d95887b4564f3f72ad38076a2d5`
- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 489f2ef2b908898d01df697dc4fe1476674be640`
- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 4a41c2b18fc05d30b718d2602cac339eae710b34`
- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < f0e441be08a2eab10b2d06fccfa267ee599dd6b3`
- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < 27ef84bba9b9d7b03418c60fbc6069ea0e87b13c`
- `Linux >= 505b5240329b922f21f91d5b5d1e535c805eca6d < f8995c2df519f382525ca4bc90553ad2ec611067`
- `Linux abc60edcfc87771ff244763d4d19c67766f5dd0f`
- `Linux a2a840d6dcae960c2dfdf3fcb1b759e1b7d90663`
- `Linux 00279b505289f7529d9be2e78915d0483ffbd314`
- `Linux d04e6ea0cec9e7d6cba806508f657d2d0dc6cacf`
- `Linux 7f3ebea19795eb38438cd3709fabf2afd53cf447`
- `Linux >= 3.16.63 < 3.17`
- `Linux >= 4.4.170 < 4.5`
- `Linux >= 4.9.148 < 4.10`
- `Linux >= 4.14.91 < 4.15`
- `Linux >= 4.19.13 < 4.20`
- `Linux 4.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.