PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45993 Linux CVE debrief

A Spectre v1 speculative execution vulnerability exists in the LoongArch Linux kernel syscall dispatch path. The syscall number supplied by userspace is used to index into the syscall function pointer table without proper bounds clamping via array_index_nospec(). This allows an attacker to train the branch predictor and speculatively execute code beyond the valid syscall table bounds, potentially leaking kernel memory through cache side channels. The vulnerability is specific to the LoongArch architecture and was resolved by adding the missing spectre boundary check.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations running LoongArch-based Linux systems, kernel maintainers for LoongArch distributions, and security teams monitoring speculative execution vulnerabilities in non-x86 architectures.

Technical summary

The LoongArch architecture's syscall entry path in the Linux kernel uses the userspace-provided syscall number to index into sys_call_table without applying array_index_nospec() clamping. This missing Spectre v1 mitigation permits out-of-bounds speculative access to the function pointer table. An attacker with local access can exploit this to speculatively execute unintended code paths and exfiltrate kernel data through cache timing analysis. The fix adds the standard array_index_nospec() boundary check to constrain speculative execution to valid syscall table entries.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from Linux stable trees once available for your distribution
  • Verify LoongArch systems are running patched kernel versions with the array_index_nospec() fix
  • Monitor vendor security advisories for LoongArch-specific kernel packages
  • Consider enabling Spectre mitigations (spectre_v1=on) if not already active on LoongArch systems
  • Review syscall-heavy workloads on LoongArch for potential attack surface reduction

Evidence notes

The CVE description confirms the vulnerability exists in the LoongArch syscall dispatch table where userspace-controlled syscall numbers lack array_index_nospec() protection. Five kernel.org stable tree commits are provided as references, indicating backports to multiple stable kernel branches. The NVD status is 'Awaiting Analysis' with no CVSS score assigned. No KEV listing exists.

Official resources

2026-05-27