Linux Kernel CVE-2026-31781

The drm/ioc32 subsystem implements the 32-bit compat ioctl interface for the DRM (Direct Rendering Manager) subsystem on 64-bit Linux kernels, allowing 32-bit userspace processes to communicate with graphics drivers. The vulnerability is a textbook Spectre v1 gadget: a caller-supplied ioctl command number is used as an index into a statically allocated table of function pointers (drm_compat_ioctls[]) without masking against speculative out-of-bounds access. On processors with branch-predictive speculative execution (Intel, AMD, ARM), the CPU transiently dereferences an attacker-controlled index before the bounds check resolves, creating a side channel through which cache timing measurements can reveal kernel memory contents. The fix applies array_index_nospec(), a Linux kernel primitive that masks the index using a bitwise AND with a CPU memory barrier to prevent speculative out-of-bounds loads, with negligible runtime overhead. CWE is listed as N/A by NVD, but the root cause class maps to CWE-1423 (Exposure of Sensitive Information caused by Shared Microarchitectural State via Speculative Execution). The CPE identifier is cpe:2.3:a:linux:linux.