High 7.8Published Mar 25, 2026

CVE-2026-23354x86/fred: Correct speculative safety in fred_extint()

Updated under an hour ago (Oct 28, 2026, 1:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no use if the result gets spilled to the stack, as it makes the believed safe-under-speculation value subject to memory predictions. For all practical purposes, this means array_index_nospec() must be used in the expression that accesses the array. As the code currently stands, it's the wrong side of irqentry_enter(), and 'index' is put into %ebp across the function call. Remove the index variable and reposition array_index_nospec(), so it's calculated immediately before the array access.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	14619d912b658ecd9573fb88400d3830a29cadcb builds before 3bc5887b0a2b06d2d9c22f1f4f8500490b3ae643; from 14619d912b658ecd9573fb88400d3830a29cadcb before e58f1a9b0677de24dcfee0b21393446ec92ff120; 14619d912b658ecd9573fb88400d3830a29cadcb builds before 92caa5274b99cb6729177232a029ce0dfa6c5f7b; from 14619d912b658ecd9573fb88400d3830a29cadcb before aa280a08e7d8fae58557acc345b36b3dc329d595	CNA record
linux linux_kernel linux:linux_kernel	from 6.9.1 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7; 6.9; 7.0; 7.0; 7.0; 7.0; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/3bc5887b0a2b06d2d9c22f1f4f8500490b3ae643	patch
https://git.kernel.org/stable/c/e58f1a9b0677de24dcfee0b21393446ec92ff120	patch
https://git.kernel.org/stable/c/92caa5274b99cb6729177232a029ce0dfa6c5f7b	patch
https://git.kernel.org/stable/c/aa280a08e7d8fae58557acc345b36b3dc329d595	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.