CVE-2026-23354
published 2026-03-25CVE-2026-23354: In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no use if the…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint()
array_index_nospec() is no use if the result gets spilled to the stack, as
it makes the believed safe-under-speculation value subject to memory
predictions.
For all practical purposes, this means array_index_nospec() must be used in
the expression that accesses the array.
As the code currently stands, it's the wrong side of irqentry_enter(), and
'index' is put into %ebp across the function call.
Remove the index variable and reposition array_index_nospec(), so it's
calculated immediately before the array access.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.8-1 (forky) | linux 6.19.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 14619d912b658ecd9573fb88400d3830a29cadcb < 3bc5887b0a2b06d2d9c22f1f4f8500490b3ae643 | 3bc5887b0a2b06d2d9c22f1f4f8500490b3ae643 |
| linux | linux | >= 14619d912b658ecd9573fb88400d3830a29cadcb < e58f1a9b0677de24dcfee0b21393446ec92ff120 | e58f1a9b0677de24dcfee0b21393446ec92ff120 |
| linux | linux | >= 14619d912b658ecd9573fb88400d3830a29cadcb < 92caa5274b99cb6729177232a029ce0dfa6c5f7b | 92caa5274b99cb6729177232a029ce0dfa6c5f7b |
| linux | linux | >= 14619d912b658ecd9573fb88400d3830a29cadcb < aa280a08e7d8fae58557acc345b36b3dc329d595 | aa280a08e7d8fae58557acc345b36b3dc329d595 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.8-1 | 6.19.8-1 |
| linux | linux_kernel | >= 6.13 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.13.0 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.19 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.19.0 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.9.0 < 6.12.77 | 6.12.77 |
| linux | linux_kernel | >= 6.9.1 < 6.12.77 | 6.12.77 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat3.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4jgp-jccm-6ppx: In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint()
array_index_nospec() is no
ghsa_unreviewed·2026-03-25
CVE-2026-23354 GHSA-4jgp-jccm-6ppx: In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint()
array_index_nospec() is no
In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint()
array_index_nospec() is no use if the result gets spilled to the stack, as
it makes the believed safe-under-speculation value subject to memory
predictions.
For all practical purposes, this means array_index_nospec() must be used in
the expression that accesses the array.
As the code currently stands, it's the wrong side of irqentry_enter(), and
'index' is put into %ebp across the function call.
Remove the index variable and reposition array_index_nospec(), so it's
calculated immediately before the array access.
OSV
CVE-2026-23354: In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no u
osv·2026-03-25
CVE-2026-23354 CVE-2026-23354: In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no u
In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no use if the result gets spilled to the stack, as it makes the believed safe-under-speculation value subject to memory predictions. For all practical purposes, this means array_index_nospec() must be used in the expression that accesses the array. As the code currently stands, it's the wrong side of irqentry_enter(), and 'index' is put into %ebp across the function call. Remove the index variable and reposition array_index_nospec(), so it's calculated immediately before the array access.
OSV
x86/fred: Correct speculative safety in fred_extint()
osv·2026-03-25
CVE-2026-23354 x86/fred: Correct speculative safety in fred_extint()
x86/fred: Correct speculative safety in fred_extint()
In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint()
array_index_nospec() is no use if the result gets spilled to the stack, as
it makes the believed safe-under-speculation value subject to memory
predictions.
For all practical purposes, this means array_index_nospec() must be used in
the expression that accesses the array.
As the code currently stands, it's the wrong side of irqentry_enter(), and
'index' is put into %ebp across the function call.
Remove the index variable and reposition array_index_nospec(), so it's
calculated immediately before the array access.
Red Hat
kernel: x86/fred: Correct speculative safety in fred_extint()
vendor_redhat·2026-03-25·CVSS 3.3
CVE-2026-23354 [MEDIUM] CWE-1037 kernel: x86/fred: Correct speculative safety in fred_extint()
kernel: x86/fred: Correct speculative safety in fred_extint()
In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint()
array_index_nospec() is no use if the result gets spilled to the stack, as
it makes the believed safe-under-speculation value subject to memory
predictions.
For all practical purposes, this means array_index_nospec() must be used in
the expression that accesses the array.
As the code currently stands, it's the wrong side of irqentry_enter(), and
'index' is put into %ebp across the function call.
Remove the index variable and reposition array_index_nospec(), so it's
calculated immediately before the array access.
A flaw was found in the Linux kernel. This vulnerability affects the handling of speculative exe
Debian
CVE-2026-23354: linux - In the Linux kernel, the following vulnerability has been resolved: x86/fred: C...
vendor_debian·2026
CVE-2026-23354 [LOW] CVE-2026-23354: linux - In the Linux kernel, the following vulnerability has been resolved: x86/fred: C...
In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no use if the result gets spilled to the stack, as it makes the believed safe-under-speculation value subject to memory predictions. For all practical purposes, this means array_index_nospec() must be used in the expression that accesses the array. As the code currently stands, it's the wrong side of irqentry_enter(), and 'index' is put into %ebp across the function call. Remove the index variable and reposition array_index_nospec(), so it's calculated immediately before the array access.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.19.8-1)
sid: resolved (fixed in 6.19.8-1)
trixie: open
No detection rules found.
No public exploits indexed.
2026-03-25
Published