Linux Kernel CVE-2026-45993

Exploitation requires a local, authenticated user session on a LoongArch-architecture Linux system - no remote or network vector exists. The attacker must be able to execute arbitrary syscalls (standard for any unprivileged user process). The missing array_index_nospec() boundary is architecture-specific to LoongArch; x86, ARM, and other architectures are not affected by this specific patch. Spectre v1 side-channel exploitation additionally requires the ability to perform high-resolution cache timing measurements, which can be restricted (though not fully blocked) by reducing timer resolution via prctl(PR_SET_TSC) or disabling unprivileged eBPF timers. What limits exploitation: LoongArch hardware is a narrow deployment footprint, practical Spectre v1 exploitation is technically complex and environment-sensitive, and the flaw requires local code execution - remote unauthenticated exploitation is not possible.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) scores this as a local availability impact, which is inconsistent with the Spectre-class mechanism described - Spectre v1 exploits are fundamentally information disclosure primitives, not crash vectors. The 'Information Disclosure' tag in the source data aligns with the technical nature of the flaw but directly contradicts the C:N assignment; this conflict is unresolved and should be verified against the upstream kernel fix commit and any associated security advisory. EPSS at 0.02% (5th percentile) reflects very low mass-exploitation probability, consistent with the architectural specificity of LoongArch and the complexity of Spectre-class side-channel exploitation. No CISA KEV listing confirms no observed active exploitation at time of analysis. The attack surface is limited to local, authenticated users on LoongArch hardware - a relatively narrow deployment footprint compared to x86/ARM. Despite the ambiguous CVSS impact scoring, defenders on LoongArch systems should treat this as a meaningful kernel information disclosure risk consistent with other Spectre v1 patches.

A local unprivileged user on a LoongArch Linux system crafts a syscall invocation with an out-of-bounds syscall number. The kernel's bounds check is present in the committed path, but the missing array_index_nospec() permits the CPU to speculatively load a function pointer from beyond the dispatch table before the branch resolves. The attacker then uses Flush+Reload or Prime+Probe cache timing measurements in a tight loop to infer the transiently accessed kernel memory value, gradually reconstructing kernel data. No public proof-of-concept specific to this LoongArch path has been identified.