Linux Kernel EUVD-2026-24846

The s390 architecture implements syscall dispatch via a function pointer table indexed by the syscall number. Unlike other architectures and mitigations for Spectre variant 1 attacks, the s390 implementation was missing the array_index_nospec() boundary check that prevents speculative execution from accessing out-of-bounds table entries. When a user-controlled syscall number is passed to the kernel without bounds validation wrapped in array_index_nospec(), an attacker can craft an invalid syscall index that causes the processor to speculatively access memory beyond the legitimate syscall table, triggering a kernel panic or information leak via side-channel. The fix applies speculative load hardening to the syscall dispatch path, a standard Spectre mitigation technique. This affects all s390 Linux kernel versions prior to the patched releases identified in the CVE data.