CVE-2026-23354: x86/fred: Correct speculative safety in fred_extint()
In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fredextint()
arrayindexnospec() is no use if the result gets spilled to the stack, as it makes the believed safe-under-speculation value subject to memory predictions.
For all practical purposes, this means arrayindexnospec() must be used in the expression that accesses the array.
As the code currently stands, it's the wrong side of irqentryenter(), and 'index' is put into %ebp across the function call.
Remove the index variable and reposition arrayindexnospec(), so it's calculated immediately before the array access.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects the x86 Linux kernel code path for FRED external interrupts. The provided data does not identify specific kernel versions or configurations beyond the x86/FRED context.
What level of access does an attacker need?
The CVSS vector indicates local access and low privileges are required, with no user interaction. Successful exploitation can affect confidentiality, integrity, and availability.
Is a fix available?
Yes. A patch is available, with fixes referenced in the stable Linux kernel repository.