CVE-2026-45993: LoongArch: Add spectre boundry for syscall dispatch table
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: Add spectre boundry for syscall dispatch table
The LoongArch syscall number is directly controlled by userspace, but does not have a arrayindexnospec() boundry to prevent access past the syscall function pointer tables.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue affects the Linux kernel on the LoongArch architecture, where syscall numbers supplied by userspace are used to index syscall function-pointer tables. The provided data also identifies Microsoft azl3 kernel version 6.6.139.1-1.
What does an attacker need to do to trigger the vulnerable path?
An attacker needs local ability to execute code that can invoke system calls with attacker-controlled syscall numbers. No privileges or user interaction are indicated by the supplied severity vector.
What is the practical impact?
The missing speculation boundary can allow speculative access beyond syscall function-pointer table bounds. The supplied vector rates impacts as low confidentiality and integrity impact, with high availability impact.
How can the issue be remediated?
Apply a kernel update containing the LoongArch syscall-dispatch Spectre boundary fix. The referenced stable kernel commits provide the fix history.