PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45993 Linux CVE debrief

A Spectre v1 speculative execution vulnerability exists in the LoongArch Linux kernel syscall dispatch path. The syscall number supplied by userspace is used to index into the syscall function pointer table without proper bounds clamping via array_index_nospec(). This allows an attacker to train the branch predictor and speculatively execute code beyond the valid syscall table bounds, potentially leaking kernel memory through cache side channels. The vulnerability is specific to the LoongArch architecture and was resolved by adding the missing spectre boundary check.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-19
Advisory published
2026-05-27
Advisory updated
2026-06-19

Who should care

Organizations running LoongArch-based Linux systems, kernel maintainers for LoongArch distributions, and security teams monitoring speculative execution vulnerabilities in non-x86 architectures.

Technical summary

The LoongArch architecture's syscall entry path in the Linux kernel uses the userspace-provided syscall number to index into sys_call_table without applying array_index_nospec() clamping. This missing Spectre v1 mitigation permits out-of-bounds speculative access to the function pointer table. An attacker with local access can exploit this to speculatively execute unintended code paths and exfiltrate kernel data through cache timing analysis. The fix adds the standard array_index_nospec() boundary check to constrain speculative execution to valid syscall table entries.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from Linux stable trees once available for your distribution
  • Verify LoongArch systems are running patched kernel versions with the array_index_nospec() fix
  • Monitor vendor security advisories for LoongArch-specific kernel packages
  • Consider enabling Spectre mitigations (spectre_v1=on) if not already active on LoongArch systems
  • Review syscall-heavy workloads on LoongArch for potential attack surface reduction

Evidence notes

The CVE description confirms the vulnerability exists in the LoongArch syscall dispatch table where userspace-controlled syscall numbers lack array_index_nospec() protection. Five kernel.org stable tree commits are provided as references, indicating backports to multiple stable kernel branches. The NVD status is 'Awaiting Analysis' with no CVSS score assigned. No KEV listing exists.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45993 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45993

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45993 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45993

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/07040904ad217545be096d4280ed33c02f6a3750

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0c965d2784fbbd7f8e3b96d875c9cfdf7c00da3d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/108f2cd13577a410c0ad6ea00708596d9d0dfc90

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/85cbf7fb568af5358aae61925c4e66b8f5e1439d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bc84a109c2082dd0c4b38e8d923c046b41977533

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.