Medium 5.5Published May 1, 2026

CVE-2026-31781drm/ioc32: stop speculation on the drm_compat_ioctl path

Updated under an hour ago (Oct 28, 2026, 1:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: drm/ioc32: stop speculation on the drm_compat_ioctl path The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling array_index_nospec() on the index to the function pointer list.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 23, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	505b5240329b922f21f91d5b5d1e535c805eca6d builds before 46a60ee8956ef1975f00455f614761c7ecedc09d; 505b5240329b922f21f91d5b5d1e535c805eca6d builds before 5bb398991f378ef74d90b14a6ea8b61ff96cc03a; from 505b5240329b922f21f91d5b5d1e535c805eca6d before d59c5d8539662d95887b4564f3f72ad38076a2d5; 505b5240329b922f21f91d5b5d1e535c805eca6d builds before 489f2ef2b908898d01df697dc4fe1476674be640; 505b5240329b922f21f91d5b5d1e535c805eca6d builds before 4a41c2b18fc05d30b718d2602cac339eae710b34; from 505b5240329b922f21f91d5b5d1e535c805eca6d before f0e441be08a2eab10b2d06fccfa267ee599dd6b3; 505b5240329b922f21f91d5b5d1e535c805eca6d builds before 27ef84bba9b9d7b03418c60fbc6069ea0e87b13c; from 505b5240329b922f21f91d5b5d1e535c805eca6d before f8995c2df519f382525ca4bc90553ad2ec611067; and 10 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 3.16.63 before 3.17; from 4.4.170 before 4.5; from 4.9.148 before 4.10; from 4.14.91 before 4.15; from 4.19.13 before 4.20; from 4.20.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; and 11 more ranges	NVD

References

References

https://git.kernel.org/stable/c/46a60ee8956ef1975f00455f614761c7ecedc09d	patch
https://git.kernel.org/stable/c/5bb398991f378ef74d90b14a6ea8b61ff96cc03a	patch
https://git.kernel.org/stable/c/d59c5d8539662d95887b4564f3f72ad38076a2d5	patch
https://git.kernel.org/stable/c/489f2ef2b908898d01df697dc4fe1476674be640	patch
https://git.kernel.org/stable/c/4a41c2b18fc05d30b718d2602cac339eae710b34	patch
https://git.kernel.org/stable/c/f0e441be08a2eab10b2d06fccfa267ee599dd6b3	patch
https://git.kernel.org/stable/c/27ef84bba9b9d7b03418c60fbc6069ea0e87b13c	patch
https://git.kernel.org/stable/c/f8995c2df519f382525ca4bc90553ad2ec611067	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.