Linux kernel DRM core: unbounded index into the compat ioctl function-pointer table enables Spectre-v1 speculation

CVSS 5.5CVE-2026-31781NVIDIA / GPU stackcurated

Impact

The 32-bit compatibility ioctl entry point of the DRM core takes a user-supplied command index and uses it to pick an entry from a table of function pointers without clamping it under speculation. That is the classic Spectre-v1 gadget shape: a local caller can steer speculative execution through a mis-predicted bounds check and use it as a side channel to read kernel memory it should not see. On a GPU node this matters because /dev/dri character devices are routinely handed to tenant pods and to unprivileged rendering or compute users, so the gadget is reachable from a tenancy boundary rather than only from an admin shell. Exposure is narrow in practice: the path is the compat (32-bit userspace on a 64-bit kernel) ioctl handler, which most modern CUDA/ROCm workloads never touch, and the upstream fix is a hardening change (array_index_nospec()) rather than a repair of an observed leak.

Who can reach it

Local, authenticated: any user or container that holds an open file descriptor on a DRM device node (/dev/dri/card* or renderD*) and can issue 32-bit compat ioctls. No privilege escalation needed beyond device access.

What to do

Pick up a stable kernel containing the array_index_nospec() fix for drm_compat_ioctl and reboot the node; there is no module-level or runtime mitigation. Treat it as routine kernel maintenance - roll it into the next scheduled drain-and-reboot cycle rather than opening an emergency window, since the fix is speculative-execution hardening on a compat path. Operators who do not run 32-bit userspace against DRM devices can also reduce exposure by not exposing /dev/dri into tenant containers that do not need it.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-31781 https://git.kernel.org/stable/c/27ef84bba9b9d7b03418c60fbc6069ea0e87b13c https://git.kernel.org/stable/c/489f2ef2b908898d01df697dc4fe1476674be640

Related entries

All NVIDIA / GPU stack entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.