VulnerabilityPublished 1 May 2026Updated 6 Nov 2026

CVE-2026-31781: Linux kernel · drm/ioc32: stop speculation on the drm_compat_ioctl path

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in f8995c2df519f382525ca4bc90553ad2ec611067 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 16:33 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in f8995c2df519f382525ca4bc90553ad2ec611067, f0e441be08a2eab10b2d06fccfa267ee599dd6b3, d59c5d8539662d95887b4564f3f72ad38076a2d5 +10

Exploitation evidence

Disclosed: evidence found.
CVE published 1 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=3.16.63 <3.17 >=4.4.170 <4.5 >=4.9.148 <4.10 >=4.14.91 <4.15 >=4.19.13 <4.20	Fixed in f8995c2df519f382525ca4bc90553ad2ec611067 f0e441be08a2eab10b2d06fccfa267ee599dd6b3 d59c5d8539662d95887b4564f3f72ad38076a2d5 489f2ef2b908898d01df697dc4fe1476674be640 46a60ee8956ef1975f00455f614761c7ecedc09d 27ef84bba9b9d7b03418c60fbc6069ea0e87b13c 5bb398991f378ef74d90b14a6ea8b61ff96cc03a 4a41c2b18fc05d30b718d2602cac339eae710b34 4.20 4.15 4.10 4.5 3.17
LinuxLinux	Affected =4.20	Fixed in–

AI-suggested

A fix is available and has been applied in Linux kernel versions 4.15, 4.20, and specific commits. Users and administrators should upgrade to these fixed versions or later to mitigate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.

Description

CVE-2026-31781 is a vulnerability in the Linux kernel's drm_compat_ioctl path where a user-controlled pointer is dereferenced into a function pointer table, a pattern associated with Spectre-type issues. The flaw was addressed by applying array_index_nospec() to the index used for function pointer lookup, mitigating speculative execution risks. This vulnerability affects multiple Linux kernel versions from 3.16.63 up to and including 4.20. Fixed versions include 4.15 and 4.20 and specific commits identified by their hashes.

Impact

This vulnerability could allow speculative execution attacks via the drm_compat_ioctl path, potentially leading to information disclosure or other side-channel effects associated with Spectre-class vulnerabilities. There is no evidence of known exploits in the wild. The impact is limited to affected Linux kernel versions before the fixes were applied.

Summary

The vulnerability in the Linux kernel involves the drm_compat_ioctl path, which takes a user-controlled pointer and dereferences it into a function pointer table. This dereferencing method is a known Spectre vulnerability pattern that can lead to speculative execution attacks. The fix involves using array_index_nospec() on the index to the function pointer list to prevent speculative execution from accessing out-of-bounds function pointers. The issue affects Linux kernel versions >=3.16.63 <3.17, >=4.4.170 <4.5, >=4.9.148 <4.10, >=4.14.91 <4.15, >=4.19.13 <4.20, and =4.20. The vulnerability has been resolved in versions 4.15, 4.20, and several specific commits.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 16:33 UTC

Technical details

References

Community reviews

Related threats